CVE-2026-119065

The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'szbd-picked' checkout parameter in versions up to, and including, 3.3.0 The szbd checkout field update order meta() handler stores stripslashes(sanitize text field($ POST['szbd-picked'])) in order meta without validating the JSON structure or restricting dangerous characters, and the szbd show checkout field admin order meta() handler later concatenates the decoded lat and lng values directly into a double-quoted href attribute without esc url() or esc attr(). This makes it possible for unauthenticated attackers, by submitting an ordinary guest-checkout order with a crafted szbd-picked JSON payload, to inject arbitrary attributes (such as onmouseover) onto the Google Maps link in the WooCommerce admin order view that will execute whenever an administrator accesses an injected order.