The flaw is a reflected cross‑site scripting vulnerability caused by insufficient sanitization and output escaping of the token_id query‑string parameter in the Hippoo Mobile App for WooCommerce plugin. An unauthenticated attacker can embed malicious script payloads in token_id, send a crafted link to a victim, and when the victim’s browser processes the response the injected script runs with the victim’s privileges. This can lead to cookie theft, session hijacking, or defacement. The vulnerability is limited to client‑side code execution and does not provide direct server‑side code execution.

The affected product is Hippoo Mobile App for WooCommerce by Hippooo. All versions up to and including 1.12.0 are vulnerable. WordPress sites using any of these versions are susceptible to this flaw.

The CVSS score of 6.1 indicates medium severity, primarily because user interaction is required. EPSS is not available and it is not listed in the CISA KEV catalog. However, the practical risk can be elevated if an attacker distributes malicious links through phishing or social engineering. The attack is most likely a user visiting a crafted URL, as the endpoint bypasses the URL regex by virtue of WP_REST_Request’s query‑string precedence, enabling the malicious payload to reach the handler and execute client‑side code. No server‑side exploitation is possible, but client‑side XSS can be highly disruptive.