Shipping Zones By Drawing For Woocommerce
Monthly
Stored cross-site scripting in the Shipping Zones by Drawing for WooCommerce plugin (versions up to and including 3.3.0) allows unauthenticated attackers to plant script-bearing markup into a WooCommerce order by submitting a crafted 'szbd-picked' parameter during ordinary guest checkout. The injected JSON is persisted verbatim in order meta and later rendered inside the Google Maps link on the administrator's order-detail screen without escaping, so script executes in an administrator's browser when that specific order is opened - and, for the described onmouseover vector, when the admin hovers the link. No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); the vendor has released 3.3.1 to address it.
Stored cross-site scripting in the Shipping Zones by Drawing for WooCommerce plugin (versions up to and including 3.3.0) allows unauthenticated attackers to plant script-bearing markup into a WooCommerce order by submitting a crafted 'szbd-picked' parameter during ordinary guest checkout. The injected JSON is persisted verbatim in order meta and later rendered inside the Google Maps link on the administrator's order-detail screen without escaping, so script executes in an administrator's browser when that specific order is opened - and, for the described onmouseover vector, when the admin hovers the link. No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); the vendor has released 3.3.1 to address it.