The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'szbd-picked'…
CVE-2026-119065
The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'szbd-picked' checkout parameter in versions up to, and including, 3.3.0 The szbdcheckoutfieldupdateordermeta() handler stores stripslashes(sanitizetextfield($POST['szbd-picked'])) in order meta without validating the JSON structure or restricting dangerous characters, and the szbdshowcheckoutfieldadminordermeta() handler later concatenates the decoded lat and lng values directly into a double-quoted href attribute without escurl() or escattr(). This makes it possible for unauthenticated attackers, by submitting an ordinary guest-checkout order with a crafted szbd-picked JSON payload, to inject arbitrary attributes (such as onmouseover) onto the Google Maps link in the WooCommerce admin order view that will execute whenever an administrator accesses an injected order.
Assessment
- CVSS
- 7.2 (v3.1)
- Severity
- High
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 31 October 2026
- Last updated
- 31 October 2026
- Affected
- arosoft
- Assigner
- Wordfence
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
At the source
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e87daf87-2afb-433c-bb90-1d7469953bcc?source=cve
- https://plugins.trac.wordpress.org/browser/shipping-zones-by-drawing-for-woocommerce/tags/3.3.0/shipping-zones-by-drawing.php#L1105
- https://plugins.trac.wordpress.org/browser/shipping-zones-by-drawing-for-woocommerce/tags/3.3.0/shipping-zones-by-drawing.php#L1061
- https://plugins.trac.wordpress.org/browser/shipping-zones-by-drawing-for-woocommerce/tags/3.3.0/shipping-zones-by-drawing.php#L1133
- https://plugins.trac.wordpress.org/browser/shipping-zones-by-drawing-for-woocommerce/tags/3.3.0/shipping-zones-by-drawing.php#L1169
- https://plugins.trac.wordpress.org/log/shipping-zones-by-drawing-for-woocommerce/
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3774334%40shipping-zones-by-drawing-for-woocommerce%2Ftags%2F3.3.1&old=3769379%40shipping-zones-by-drawing-for-woocommerce%2Ftags%2F3.3.0
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-119065