---
id: CVE-2026-119065
title: >-
  Shipping Zones by Drawing for WooCommerce <= 3.3.0 - Unauthenticated Stored
  Cross-Site Scripting via 'szbd-picked' Checkout Parameter
summary: >-
  The Shipping Zones by Drawing for WooCommerce plugin for WordPress is
  vulnerable to Stored Cross-Site Scripting via the 'szbd-picked' checkout
  parameter in versions up to, and including, 3.3.0 The
  szbd_checkout_field_update_order_meta() …
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: arosoft
product: Shipping Zones by Drawing for WooCommerce
affected:
  - shipping_zones_by_drawing_for_woocommerce <= 3.3.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-01T17:34:26.356368Z'
published: '2026-10-31'
updated: '2026-11-01'
sourceUpdated: '2026-11-01T17:44:28.252Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119065'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/e87daf87-2afb-433c-bb90-1d7469953bcc?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/shipping-zones-by-drawing-for-woocommerce/tags/3.3.0/shipping-zones-by-drawing.php#L1105
  - url: >-
      https://plugins.trac.wordpress.org/browser/shipping-zones-by-drawing-for-woocommerce/tags/3.3.0/shipping-zones-by-drawing.php#L1061
  - url: >-
      https://plugins.trac.wordpress.org/browser/shipping-zones-by-drawing-for-woocommerce/tags/3.3.0/shipping-zones-by-drawing.php#L1133
  - url: >-
      https://plugins.trac.wordpress.org/browser/shipping-zones-by-drawing-for-woocommerce/tags/3.3.0/shipping-zones-by-drawing.php#L1169
  - url: >-
      https://plugins.trac.wordpress.org/log/shipping-zones-by-drawing-for-woocommerce/
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&new=3774334%40shipping-zones-by-drawing-for-woocommerce%2Ftags%2F3.3.1&old=3769379%40shipping-zones-by-drawing-for-woocommerce%2Ftags%2F3.3.0
tags:
  - cve.org
epss: 0.00241
epssPercentile: 0.15348
ingestedAt: '2026-11-05T19:30:42.597Z'
---

## Overview

The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'szbd-picked' checkout parameter in versions up to, and including, 3.3.0 The szbd_checkout_field_update_order_meta() handler stores stripslashes(sanitize_text_field($_POST['szbd-picked'])) in order meta without validating the JSON structure or restricting dangerous characters, and the szbd_show_checkout_field_admin_order_meta() handler later concatenates the decoded lat and lng values directly into a double-quoted href attribute without esc_url() or esc_attr(). This makes it possible for unauthenticated attackers, by submitting an ordinary guest-checkout order with a crafted szbd-picked JSON payload, to inject arbitrary attributes (such as onmouseover) onto the Google Maps link in the WooCommerce admin order view that will execute whenever an administrator accesses an injected order.

## Affected

- `shipping_zones_by_drawing_for_woocommerce <= 3.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.