Pay with Contact Form 7 Security & Risk Analysis

The 'pay-with-contact-form-7' plugin, version 1.0.4, exhibits a mixed security posture. While the static analysis reveals a seemingly small attack surface with no exposed AJAX handlers, REST API routes, shortcodes, or cron events without proper checks, several concerning code signals are present. The significant number of dangerous functions, specifically 'unserialize', and a concerningly low percentage of SQL queries using prepared statements (13%) indicate potential vulnerabilities. Furthermore, less than half of the output data is properly escaped, increasing the risk of Cross-Site Scripting (XSS) attacks. The plugin's vulnerability history is a major concern, with three known medium-severity CVEs, all of which are currently unpatched. The common vulnerability types reported (XSS, CSRF, SQL Injection) align with the code signals suggesting improper input handling and SQL query construction. Despite the lack of critical taint flows detected in this static analysis, the established history of unpatched vulnerabilities and the identified code weaknesses paint a picture of a plugin that requires immediate attention and patching.