CVE-2026-119065: Shipping Zones by Drawing for WooCommerce <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter

Q: Who is exposed to this issue?

WooCommerce sites using affected versions of the plugin are exposed when unauthenticated users can submit guest-checkout orders. The payload executes in the WooCommerce administrator order view when an administrator opens an injected order.

Q: What does an attacker need to exploit it?

An attacker needs only to submit a guest-checkout order with a crafted szbd-picked parameter containing malicious JSON values. No authentication or user interaction by the attacker is required.

Q: How can administrators identify potentially malicious orders?

Review guest-checkout orders for suspicious szbd-picked order-meta values, particularly latitude or longitude data containing characters or text inconsistent with coordinate values. Opening a suspicious order in the WooCommerce admin interface may trigger injected browser event attributes.

Published Oct 31, 2026

Updated

The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'szbd-picked' checkout parameter in versions up to, and including, 3.3.0 The szbdcheckoutfieldupdateordermeta() handler stores stripslashes(sanitizetextfield($POST['szbd-picked'])) in order meta without validating the JSON structure or restricting dangerous characters, and the szbdshowcheckoutfieldadminordermeta() handler later concatenates the decoded lat and lng values directly into a double-quoted href attribute without escurl() or escattr(). This makes it possible for unauthenticated attackers, by submitting an ordinary guest-checkout order with a crafted szbd-picked JSON payload, to inject arbitrary attributes (such as onmouseover) onto the Google Maps link in the WooCommerce admin order view that will execute whenever an administrator accesses an injected order.

Event History

Oct 31, 2026

CVE Published

via MITRE·06:44 AM

Data Sourced

via MITRE·06:44 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

WooCommerce sites using affected versions of the plugin are exposed when unauthenticated users can submit guest-checkout orders. The payload executes in the WooCommerce administrator order view when an administrator opens an injected order.

What does an attacker need to exploit it?

An attacker needs only to submit a guest-checkout order with a crafted szbd-picked parameter containing malicious JSON values. No authentication or user interaction by the attacker is required.

How can administrators identify potentially malicious orders?

Review guest-checkout orders for suspicious szbd-picked order-meta values, particularly latitude or longitude data containing characters or text inconsistent with coordinate values. Opening a suspicious order in the WooCommerce admin interface may trigger injected browser event attributes.

CVE-2026-119065: Shipping Zones by Drawing for WooCommerce <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can administrators identify potentially malicious orders?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can administrators identify potentially malicious orders?