CVE-2026-108483: WordPress Hippoo Mobile App for WooCommerce plugin <= 1.12.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hippooo Hippoo Mobile App for WooCommerceto a version that resolves this vulnerability.Fixed in 1.12.1
Event History
Frequently Asked Questions
Which installations are affected?
Hippoo Mobile App for WooCommerce versions through 1.12.0 are affected. The available data does not identify a fixed version.
What does an attacker need to exploit this issue?
The vulnerability is remotely reachable and requires no attacker privileges, but it requires user interaction. It is a reflected XSS issue, so exploitation involves getting a user to interact with attacker-controlled input.
What impact can successful exploitation have?
The reported vector indicates low confidentiality, integrity, and availability impact, with scope changed. Successful XSS can cause effects in a different security scope than the vulnerable component.