CVE-2023-0894 in Pickup, Delivery, Dine-in Date Time Plugin
Summary
by MITRE • 05/08/2023
The Pickup | Delivery | Dine-in date time WordPress plugin through 1.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/27/2025
The vulnerability identified as CVE-2023-0894 affects the Pickup | Delivery | Dine-in date time WordPress plugin version 1.0.9 and earlier, presenting a critical security risk through stored cross-site scripting flaws. This issue specifically targets high-privilege users including administrators who possess the capability to manipulate plugin settings, creating a pathway for persistent malicious code execution within the WordPress environment. The vulnerability stems from insufficient sanitization and escaping of user-provided input data within the plugin's administrative interfaces, particularly affecting settings that handle date and time configurations.
The technical flaw manifests when administrators or other high-privilege users interact with the plugin's settings pages where input fields are not properly validated or escaped before being stored in the database. This allows malicious payloads to be persisted in the system and executed whenever the affected pages are rendered, creating a stored XSS attack vector. The vulnerability is particularly concerning because it operates even when the unfiltered_html capability is restricted, which is a standard security measure in multisite WordPress installations and other environments where elevated privileges are carefully controlled. This means that the attack can succeed even in hardened environments where such capabilities are typically disabled to prevent XSS exploitation.
The operational impact of this vulnerability extends beyond simple script execution as it provides attackers with the ability to manipulate the plugin's functionality, potentially gaining unauthorized access to sensitive data, modifying core system configurations, or redirecting users to malicious websites. In multisite configurations, where WordPress security is typically more stringent, this vulnerability becomes even more dangerous as it bypasses standard security controls that would normally prevent such attacks. The stored nature of the vulnerability means that the malicious code persists even after the initial attack vector is closed, allowing attackers to maintain access and continue exploiting the system over extended periods.
Mitigation strategies for CVE-2023-0894 should prioritize immediate plugin updates to versions that address the sanitization and escaping deficiencies, as this represents the most direct solution to the vulnerability. System administrators should also implement additional security measures including comprehensive input validation, regular security audits of plugin configurations, and monitoring for unauthorized changes to plugin settings. The vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws, and maps to ATT&CK technique T1548.001 related to account manipulation and privilege escalation through web application vulnerabilities. Organizations should also consider implementing web application firewalls and content security policies to provide additional defense layers against exploitation attempts. Regular security assessments and vulnerability scanning should be conducted to identify similar issues in other plugins and ensure comprehensive protection against persistent threats.