Cities Shipping Zones for WooCommerce
Cities Shipping Zones for WooCommerce has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 7.2, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is PHP Remote File Inclusion, behind 1 of the records (100%).
The one issue recorded for Cities Shipping Zones for WooCommerce has a vendor fix available, so running the current release closes it.
All of these findings were reported by h0j3n. Cities Shipping Zones for WooCommerce is installed on roughly 4,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2024-47309Cities Shipping Zones for WooCommerce <= 1.2.7 - Authenticated (Shop Manager+) Local File Inclusion
Read the full analysisVulnerability Records

Cities Shipping Zones for WooCommerce
Author
Condless
WooCommerce plugin for turning the state field into a dropdown city field. To be used as Shipping Zones. Documentation | Contact How To Use Plugin Settings: Choose the countries you want to apply the plugin on (see supported countries map above). WooCommerce General Settings: Update store location country / state. WooCommerce Shipping Settings: Create shipping zone with the desired locations and its shipping methods and drag it to the top of the list. How It Works The title and the values of the built-in state field (which can be used inside shipping zones) will be changed to be as city field, on order creation the original city and state field (if applicable) will be populated based on the selected value. Features Cities Shipping: Set shipping rates per city. Bulk Select Tool: Insert multiple states/cities into shipping zone at once. Cities Sales: Track the sales stats per city (Dashbaord => WooCommerce => Reports => Orders => Sales by city). Cities Shipping Calculator: Display the cities shipping calculator in any page using the [csz_cities] or [csz_cities template="popup"] shortcode Integrations: Delivery days per city, Minimum order amount per city, Discounts per city, Payment methods per city, Shipping methods for products per city, WooCommerce REST API.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C