CVE-2026-119065 in Shipping Zones by Drawing for WooCommerce Plugin
Summary
by MITRE • 10/31/2026
The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'szbd-picked' checkout parameter in versions up to, and including, 3.3.0 The szbd_checkout_field_update_order_meta() handler stores stripslashes(sanitize_text_field($_POST['szbd-picked'])) in order meta without validating the JSON structure or restricting dangerous characters, and the szbd_show_checkout_field_admin_order_meta() handler later concatenates the decoded lat and lng values directly into a double-quoted href attribute without esc_url() or esc_attr(). This makes it possible for unauthenticated attackers, by submitting an ordinary guest-checkout order with a crafted szbd-picked JSON payload, to inject arbitrary attributes (such as onmouseover) onto the Google Maps link in the WooCommerce admin order view that will execute whenever an administrator accesses an injected order.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/31/2026
The Shipping Zones by Drawing for WooCommerce plugin for WordPress contains a critical stored cross-site scripting vulnerability affecting versions up to and including 3.3.0. This flaw resides within the administrative interface of the e-commerce platform, specifically triggered during the processing of guest checkout orders. The vulnerability allows unauthenticated attackers to inject malicious JavaScript payloads that persist in the database and execute when an administrator views specific order details. Because the attack vector requires no authentication for initial exploitation but relies on privileged access for execution, it represents a significant risk to site integrity and administrative security.
The technical root cause lies in improper input validation and output encoding within two primary handlers: szbd_checkout_field_update_order_meta and szbd_show_checkout_field_admin_order_meta. When a customer submits an order via the guest checkout process, the plugin accepts data from the szbd-picked parameter. The update handler processes this input by applying stripslashes to remove backslashes and then passes it through sanitize_text_field. While sanitize_text_field performs basic sanitization against common HTML tags, it does not validate JSON structure or restrict all dangerous characters effectively in this context. Consequently, a crafted JSON payload containing malicious attributes can bypass these checks if the content is structured to evade simple tag filtering.
The critical failure occurs when the admin order meta handler retrieves and displays this stored data. The szbd_show_checkout_field_admin_order_meta function extracts latitude and longitude values from the previously stored input and concatenates them directly into a double-quoted href attribute of an HTML anchor element linking to Google Maps. This output is generated without using WordPress escaping functions such as esc_url or esc_attr. As a result, if the injected payload includes attributes like onmouseover or onclick within the coordinate data, these are rendered literally in the DOM rather than being escaped. The lack of proper context-aware encoding allows arbitrary HTML and JavaScript to be inserted into the page structure.
From an operational perspective, this vulnerability enables stored cross-site scripting attacks against site administrators. An attacker can craft a malicious szbd-picked payload that embeds event handlers or script tags within the coordinate data. When an administrator navigates to the order details page in the WooCommerce admin dashboard, the browser parses the malformed href attribute and executes the injected code. This execution occurs in the context of the administrator's session, granting the attacker the same privileges as the logged-in user. Potential impacts include theft of administrative cookies or session tokens, leading to full account takeover, defacement of the administration panel, redirection to phishing sites, or installation of persistent backdoors within the WordPress environment.
This vulnerability aligns with CWE-79, which covers Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting. Specifically, it demonstrates a failure in output encoding relative to the HTML attribute context. In terms of attack classification under MITRE ATT&CK for Enterprise, this falls under T1059.007 JavaScript Execution and potentially T1133 External Remote Services if used for initial access or persistence through administrative compromise. The unauthenticated nature of the input submission makes it particularly dangerous as it does not require prior authentication to plant the payload.
Mitigation strategies should focus on immediate remediation and defensive coding practices. Administrators running affected versions must update the Shipping Zones by Drawing plugin to a patched version where these handlers have been corrected. Developers implementing similar functionality must ensure that all user-supplied data is strictly validated against expected formats, such as verifying JSON structure before processing coordinates. Furthermore, output encoding is paramount; any dynamic content inserted into HTML attributes must be passed through appropriate escaping functions like esc_attr or esc_url to neutralize special characters and prevent attribute injection. Implementing Content Security Policy headers can also provide an additional layer of defense by restricting the sources from which scripts are allowed to execute, thereby mitigating the impact of successful XSS attempts even if input validation fails.