Threats tagged 'ghsa-jj4c-mvqc-72v2'

The Shipping Zones by Drawing for WooCommerce plugin for WordPress versions up to and including 3.3.0 is vulnerable to stored cross-site scripting (XSS) via the 'szbd-picked' checkout parameter. An unauthenticated attacker can submit a crafted JSON payload during guest checkout that injects malicious attributes into a Google Maps link in the WooCommerce admin order view. This malicious code executes when an administrator views the injected order, potentially compromising the admin interface.