Live › vulnerability › CVE-2026-119065
The Shipping Zones by Drawing for WooCommerce plugin stores unvalidated checkout data and prints it unescaped into an admin order page link. An unauthenticated shopper can place a crafted order that runs JavaScript in the browser of an administrator who opens that order.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 07:34 UTC. All times on this page are UTC.
Stores running the Shipping Zones by Drawing for WooCommerce plugin at version 3.3.0 or earlier are exposed, since guest checkout writes the malicious value into order data. Any admin who opens the affected order in the WooCommerce admin can trigger the script. Stores without this plugin, or on a newer version, can skip it.
No product ranges from the sources yet.
Shipping Zones by Drawing for WooCommerce (slug likely szbd) is installed and its version under Plugins in wp-admin.3.3.0 (the sources say versions up to and including 3.3.0 are affected).3.3.0; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'szbd-picked' checkout parameter in versions up to, and including, 3.3.0 The szbd_checkout_field_update_order_meta() handler stores stripslashes(sanitize_text_field($_POST['szbd-picked'])) in order meta without validating the JSON structure or restricting dangerous characters, and the szbd_show_checkout_field_admin_order_meta() handler later concatenates the decoded lat and lng values directly into a double-quoted href attribute without esc_url() or esc_attr(). This makes it possible for unauthenticated attackers, by submitting an ordinary guest-checkout order with a crafted szbd-picked JSON payload, to inject arbitrary attributes (such as onmouseover) onto the Google Maps link in the WooCommerce admin order view that will execute whenever an administrator accesses an injected order.
This page as .md · .json · in your agent: get_signal("CVE-2026-119065")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.