Advisories · Technology

hippooo Hippoo Mobile App for WooCommerce.

Every CVE that names hippooo Hippoo Mobile App for WooCommerce among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-111601 CVE record

CVSS 6.1 Medium

Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' Parameter
- hippooo Hippoo Mobile App for WooCommerce
- Cross-site scripting (XSS)
Not analysed yet 17 Oct 2026
CVE-2026-108483 CVE record

CVSS 7.1 High

WordPress Hippoo Mobile App for WooCommerce plugin <= 1.12.0 - Cross Site Scripting (XSS) vulnerability
- hippooo Hippoo Mobile App for WooCommerce
- Cross-site scripting (XSS)
Not analysed yet 14 Oct 2026
CVE-2026-49065 CVE record

CVSS 8.2 High

WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.5 - Broken Access Control vulnerability
- hippooo Hippoo Mobile App for WooCommerce
- Broken access control
Not analysed yet 15 Jun 2026
CVE-2026-10580 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Hippoo Mobile App for WooCommerce <= 1.9.4 - Unauthenticated Authentication Bypass to Administrator Account Takeover via REST API
- hippooo Hippoo Mobile App for WooCommerce
- Broken access control
Not analysed yet 5 Jun 2026
CVE-2025-12655 CVE record

CVSS 5.3 Medium

Hippoo Mobile App for WooCommerce <= 1.7.1 - Missing Authorization to Unauthenticated Limited File Write
- hippooo Hippoo Mobile App for WooCommerce
- Broken access control
Not analysed yet 12 Dec 2025
CVE-2025-13339 CVE record

CVSS 7.5 High

Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read
- hippooo Hippoo Mobile App for WooCommerce
- Path traversal
Not analysed yet 10 Dec 2025