CVE-2026-111601: Hippoo Mobile App WooCommerce XSS Vulnerability

CVE-2026-111601 Overview

CVE-2026-111601 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Hippoo Mobile App for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 1.12.0. It stems from insufficient input sanitization and output escaping on the token_id parameter in the plugin's REST handler. Unauthenticated attackers can inject arbitrary web scripts that execute when a user is tricked into clicking a crafted link. The vulnerability is tracked under CWE-79.

Critical Impact
An unauthenticated attacker can execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, or privileged actions if an administrator is targeted.

Affected Products

Hippoo Mobile App for WooCommerce plugin for WordPress
All versions through 1.12.0
Deployments exposing the plugin's REST endpoint rest.php

Discovery Timeline

2026-10-17 - CVE-2026-111601 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-111601

Vulnerability Analysis

The vulnerability resides in the plugin's REST route handling implemented in app/rest.php. The route registration uses a URL path regex that constrains the path segment to word characters, which would normally prevent injection of script-breaking metacharacters. However, WordPress's WP_REST_Request applies query-string parameter precedence over URL-derived parameters. An attacker supplies a ?token_id= value in the query string that overrides the path-matched value and reaches the handler verbatim.

The handler then reflects the attacker-controlled token_id into the response without proper sanitization or output escaping. Because the regex constraint is bypassed entirely, arbitrary HTML and JavaScript payloads can be delivered to the victim's browser.

Root Cause

The root cause is a conflict between route-path validation and query-parameter precedence in the WordPress REST API. The developer relied on a path regex (word characters only) as the input validator, assuming it would restrict the token_id value. The handler never applied sanitize_text_field() or esc_html() to the parameter before echoing it, and the WordPress REST layer silently overrides path parameters with query-string values of the same name.

Attack Vector

Exploitation requires user interaction. An attacker crafts a URL to the plugin's REST endpoint with a malicious token_id query parameter containing JavaScript payload. The attacker delivers the link via phishing email, chat, or an attacker-controlled site. When the victim clicks the link, the reflected payload executes in the context of the vulnerable WordPress origin. See the Wordfence Vulnerability Analysis and the WordPress Plugin Code Review at rest.php L422 for technical details.

Detection Methods for CVE-2026-111601

Indicators of Compromise

HTTP request logs containing token_id= query parameters with URL-encoded <script>, onerror=, javascript:, or %3C sequences targeting the Hippoo REST endpoint.
Referrer headers from external domains pointing to the plugin's REST routes defined in rest.php.
Unexpected outbound requests from administrator browser sessions shortly after visiting WordPress admin or front-end pages.

Detection Strategies

Inspect web server access logs for requests to Hippoo plugin REST paths that include a token_id query parameter with non-word characters.
Deploy a Web Application Firewall (WAF) rule to flag or block query strings containing HTML tags or JavaScript event handlers reaching the plugin endpoint.
Correlate reflected XSS payload patterns with user-agent strings and session cookies to identify targeted administrators.

Monitoring Recommendations

Alert on anomalous WordPress REST API traffic volume or sources that previously had no interaction history with the site.
Monitor WordPress admin accounts for unauthorized plugin, user, or theme changes following click-through events.
Track outbound HTTP requests from browsers to attacker-controlled hosts following interaction with vulnerable WordPress endpoints.

How to Mitigate CVE-2026-111601

Immediate Actions Required

Update the Hippoo Mobile App for WooCommerce plugin to the patched version released in WordPress Changeset 3739429.
If the plugin cannot be updated immediately, deactivate and remove it until the patched version is deployed.
Audit WordPress administrator accounts and rotate credentials and API tokens that may have been exposed via a successful XSS payload.

Patch Information

The vendor addressed the vulnerability in the commit tracked as WordPress Changeset 3739429. The fix updates app/rest.php to sanitize and escape the token_id parameter before it is reflected back in the HTTP response. Site administrators should upgrade to any Hippoo Mobile App for WooCommerce release later than 1.12.0.

Workarounds

Add a WAF rule that blocks requests to the Hippoo REST endpoint when token_id contains characters outside [A-Za-z0-9_-].
Enforce a strict Content Security Policy (CSP) that disallows inline scripts to limit reflected XSS execution.
Restrict access to the WordPress REST API from untrusted networks where feasible, using IP allowlists or authentication gating at the edge.

bash

# Example WAF rule (ModSecurity) to block suspicious token_id values
SecRule ARGS:token_id "@rx [^A-Za-z0-9_-]" \
    "id:1026111601,phase:2,deny,status:403,\
    msg:'CVE-2026-111601 Hippoo token_id XSS attempt blocked'"