Hippoo Mobile App EUVD-2026-101526

Exploitation requires that a victim with an active session on the WordPress/WooCommerce site (reflected XSS is most impactful against a logged-in administrator) clicks an attacker-crafted link pointing at the vulnerable Hippoo endpoint - this user interaction (UI:R) is the primary limiting factor. The affected software must be the Hippoo Mobile App for WooCommerce plugin at version 1.12.0 or earlier. No authentication is required of the attacker to construct the payload (PR:N), and no special non-default configuration is indicated in the description, but successful impact depends on social-engineering delivery and the victim's authenticated context; being reflected rather than stored, the payload is not persistently served to all visitors.

This is a moderate-severity reflected XSS (CVSS 7.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) in the Hippoo Mobile App for WooCommerce WordPress plugin, scored and reported by Patchstack. The CVSS vector signals a network-reachable, low-complexity, unauthenticated attack whose only real gating factor is required user interaction (UI:R) - the victim must be lured into clicking a crafted link. No EPSS score, CISA KEV listing, or POC reference was provided, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The scope-change (S:C) and low C/I/A impacts are consistent with browser-context script execution rather than direct server compromise. Net assessment: a genuine but not emergency-grade issue - reflected (not stored) XSS requires social-engineering delivery per victim, which lowers real-world blast radius compared to the raw 7.1 score, and the niche plugin footprint further limits exposure. Prioritize patching but it is unlikely to be a mass-exploitation target. Note: EPSS and POC status are simply absent from the input, not confirmed negative.

An attacker crafts a malicious URL targeting a vulnerable endpoint of the Hippoo plugin where unsanitized input is reflected into the response page, then delivers it to a logged-in store administrator or customer via phishing. When the victim clicks the link, attacker-controlled JavaScript executes in their browser session in the context of the WooCommerce site. Because the flaw is reflected (AV:N/AC:L/PR:N/UI:R), no authentication is needed to build the payload but the attack only succeeds if the victim interacts with the crafted link; no public exploit code was referenced.