Nexi XPay Security & Risk Analysis

The "cartasi-x-pay" v8.3.1 plugin exhibits significant security concerns due to a large attack surface with a high proportion of unprotected entry points. Specifically, 14 AJAX handlers and 5 REST API routes lack proper authentication or permission checks. While the plugin demonstrates good practices with SQL queries all using prepared statements and no dangerous functions are identified, the lack of output escaping on a substantial portion (66%) of outputs poses a risk of Cross-Site Scripting (XSS) vulnerabilities.

The absence of nonce checks on AJAX handlers, coupled with the unescaped outputs, creates a direct pathway for potential XSS attacks. The taint analysis, although limited, did not reveal critical or high-severity unsanitized flows, but this could be due to the limited scope of analysis or the lack of direct input to those flows. The plugin's history of zero known CVEs is a positive indicator, but it does not mitigate the immediate risks identified in the static analysis. The plugin's strengths lie in its SQL handling and lack of bundled libraries, but these are overshadowed by the critical exposure of its entry points and output handling deficiencies.