WooCommerce Shipping Zones Plugin Stored XSS via Checkout Parameters

The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'szbd-picked' checkout parameter in versions up to, and including, 3.3.0 The szbd_checkout_field_update_order_meta() handler stores stripslashes(sanitize_text_field($_POST['szbd-picked'])) in order meta without validating the JSON structure or restricting dangerous characters, and the szbd_show_checkout_field_admin_order_meta() handler later concatenates the decoded lat and lng values directly into a double-quoted href attribute without esc_url() or esc_attr(). This makes it possible for unauthenticated attackers, by submitting an ordinary guest-checkout order with a crafted szbd-picked JSON payload, to inject arbitrary attributes (such as onmouseover) onto the Google Maps link in the WooCommerce admin order view that will execute whenever an administrator accesses an injected order.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Shipping Zones by Drawing for WooCommerce plugin contains a stored cross-site scripting (XSS) vulnerability affecting versions up to 3.3.0. The vulnerability exists in the checkout parameter handler, which fails to properly validate and sanitize user-supplied JSON data before storing it in order metadata. Attackers can inject malicious JavaScript through the 'szbd-picked' parameter during checkout, which persists in the database and executes whenever order data is viewed—particularly in the WordPress admin interface. This affects all WooCommerce store administrators and customers who process orders through compromised installations, as the stored payload executes with admin privileges when order details are displayed.

Casky's 323 mapped security skills leverage Claude AI with extended reasoning to detect this attack pattern across MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would identify multiple detection indicators: incomplete input validation patterns in plugin code analysis (CWE-79 detection), suspicious JSON structure handling in POST parameter processing, and unsafe concatenation of user-controlled lat/lng coordinates in admin output contexts. The platform's skills would flag the specific weakness—sanitize_text_field() being insufficient for JSON validation—and highlight the critical gap between storage and output encoding. Security teams would see findings categorized under web application attack techniques, identifying this as a persistence mechanism that enables admin-level code execution through the WordPress administrative interface.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-119065.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-119065

Casky has 323 skills that investigate the attack patterns behind CVE-2026-119065. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn