Shipping Zones by Drawing EUVD-2026-114614

The target must be a WordPress store running WooCommerce with this plugin at version <=3.3.0 and guest checkout enabled so the attacker can submit the 'szbd-picked' checkout parameter. The attacker needs no account - exploitation is unauthenticated injection during a normal checkout. The decisive limiting factor is that the stored payload does not execute at injection time: it fires only when a logged-in administrator later opens the specific attacker-created order in the WooCommerce admin order view, and for the described onmouseover vector the admin must additionally hover over the injected Google Maps link. There is no remote-code or data-read impact without this administrator interaction, which meaningfully narrows realistic exploitation despite the unauthenticated injection path.

This is a genuine but second-tier priority rather than an emergency. The CVSS 7.2 (High) rating is driven by the combination of unauthenticated network injection (AV:N/AC:L/PR:N) and a scope change (S:C), reflecting that stored XSS in the WooCommerce admin order view executes in a privileged administrator's authenticated session and can be leveraged toward site takeover (e.g., creating rogue admins or planting backdoors via the admin's context). However, the input provides no EPSS score and no KEV listing, so widespread or confirmed exploitation cannot be asserted; the only sourcing is a Wordfence threat-intel advisory and the WordPress.org trac source/changeset links, which document the flaw and fix but are not verified working exploit code. The vuln.today priority is 'this_week', consistent with act-soon-but-not-act-now. A key tempering factor the raw score understates: the payload fires only after an administrator opens the attacker's injected order (and, for the specific onmouseover vector described, hovers the Google Maps link), so real exploitation depends on admin behavior - the NVD/Wordfence UI:N is debatable and UI:R is more defensible (see assessed vector). Net: a real stored-XSS risk worth patching promptly, but not evidence of mass active exploitation.

An unauthenticated attacker places an ordinary guest-checkout order on a store running the plugin (<=3.3.0) and submits a crafted 'szbd-picked' JSON value whose lat/lng fields break out of the href attribute and add an event handler such as onmouseover. When a store administrator later opens that order in the WooCommerce admin and interacts with the injected Google Maps link, the attacker's script runs in the admin's authenticated session. No public working exploit is identified in the provided data, though Wordfence has published an advisory.