CVE-2026-119065 arosoft CVE debrief

Who should care

Administrators and security teams responsible for WordPress and WooCommerce installations, particularly those using the Shipping Zones by Drawing for WooCommerce plugin, should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-119065 is a Stored Cross-Site Scripting vulnerability in the Shipping Zones by Drawing for WooCommerce plugin for WordPress. It allows unauthenticated attackers to inject arbitrary attributes onto the Google Maps link in the WooCommerce admin order view. Administrators and security teams should prioritize verifying and updating the plugin, monitoring for exploitation attempts, and implementing additional security measures to prevent similar vulnerabilities.

• Unauthenticated attackers can inject arbitrary attributes onto the Google Maps link in the WooCommerce admin order view
• Administrators accessing injected orders may execute malicious code
• Verify and update the plugin to a patched version to prevent exploitation
• Monitor for potential exploitation attempts and review order meta for suspicious activity

Technical summary

The szbd_checkout_field_update_order_meta() handler stores user-input data in order meta without proper validation or sanitization, and the szbd_show_checkout_field_admin_order_meta() handler concatenates this data into a double-quoted href attribute without proper escaping. This allows unauthenticated attackers to inject arbitrary attributes, such as onmouseover, onto the Google Maps link in the WooCommerce admin order view.

Defensive priority

Administrators and security teams should prioritize verifying and updating the plugin to a patched version, and monitoring for potential exploitation attempts.

Recommended defensive actions

• Verify and update the Shipping Zones by Drawing for WooCommerce plugin to a patched version (3.3.1 or later)
• Monitor for potential exploitation attempts and review order meta for suspicious activity
• Implement additional security measures, such as input validation and output encoding, to prevent similar vulnerabilities
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was discovered in the Shipping Zones by Drawing for WooCommerce plugin, specifically in the szbd_checkout_field_update_order_meta() and szbd_show_checkout_field_admin_order_meta() handlers. The szbd-picked checkout parameter is not properly validated or sanitized, allowing for stored cross-site scripting.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.