---
id: "CVE-2026-119065"
kind: "vulnerability"
aliases: ["CVE-2026-119065"]
title: "WordPress WooCommerce shipping plugin: stored XSS runs in admin order view"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "shipping-zones-by-drawing", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-above-3.3.0"]
published_at: "2026-10-31T07:16:36+00:00"
first_seen_at: "2026-10-31T07:34:07+00:00"
updated_at: "2026-10-31T07:34:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119065", "first_seen_at": "2026-10-31T07:34:07+00:00"}]
---

# WordPress WooCommerce shipping plugin: stored XSS runs in admin order view

The Shipping Zones by Drawing for WooCommerce plugin stores unvalidated checkout data and prints it unescaped into an admin order page link. An unauthenticated shopper can place a crafted order that runs JavaScript in the browser of an administrator who opens that order.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the WordPress plugin `Shipping Zones by Drawing for WooCommerce` (slug likely `szbd`) is installed and its version under Plugins in wp-admin.
- Confirm the installed version is above `3.3.0` (the sources say versions up to and including `3.3.0` are affected).

## Fix

- Move the Shipping Zones by Drawing for WooCommerce plugin to a version later than `3.3.0`; the sources do not name the fixed version.

## Timeline

- 2026-10-31T07:34:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119065

## From the sources

The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'szbd-picked' checkout parameter in versions up to, and including, 3.3.0 The szbd_checkout_field_update_order_meta() handler stores stripslashes(sanitize_text_field($_POST['szbd-picked'])) in order meta without validating the JSON structure or restricting dangerous characters, and the szbd_show_checkout_field_admin_order_meta() handler later concatenates the decoded lat and lng values directly into a double-quoted href attribute without esc_url() or esc_attr(). This makes it possible for unauthenticated attackers, by submitting an ordinary guest-checkout order with a crafted szbd-picked JSON payload, to inject arbitrary attributes (such as onmouseover) onto the Google Maps link in the WooCommerce admin order view that will execute whenever an administrator accesses an injected order.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_