These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_id' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an acti [truncated]
A Cross Site Scripting (XSS) vulnerability exists in the WordPress Hippoo Mobile App for WooCommerce plugin versions up to 1.12.0. This issue, known as CVE-2026-108483, was publicly disclosed on October 14, 2026, and last modified on October 16, 2026. The vulnerability allows for Reflected XSS attacks. The CVE Program record and NVD detail page provide official information on this vulnerability.
CVE-2026-49065 is a high-severity vulnerability (CVSS Score: 8.2) affecting the Hippoo Mobile App for WooCommerce plugin versions <= 1.9.5. This vulnerability is classified as Unauthenticated Broken Access Control. The vulnerability was published on [cve-org](https://www.cve.org/CVERecord?id=CVE-2026-49065) and additional details can be found on [nvd](https://nvd.nist.gov/vuln/detail/CVE-2026-49065).
CVE-2026-10580 is a critical vulnerability in the Hippoo Mobile App for WooCommerce plugin for WordPress. The plugin is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This issue arises from a logic conflation in `HippooPermissions::get_user_permissions()`, which returns the same null sentinel for both administrators and unauthentica [truncated]