The Shipping Zones by Drawing for WooCommerce plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to and including 3.3.0. This flaw arises from improper sanitization and validation of the 'szbd-picked' checkout parameter, allowing unauthenticated attackers to inject malicious attributes into the Google Maps link shown in the WooCommerce admin order view. The vulnerability can lead to arbitrary script execution when an administrator views the injected order.