Opayo Direct Gateway for Gravity Forms Security & Risk Analysis

The plugin "sagepay-direct-gateway-for-gravity-forms" v1.0.2 exhibits a generally positive security posture with no known vulnerabilities in its history. The static analysis reveals a commendable absence of dangerous functions, raw SQL queries, file operations, and a relatively low number of external HTTP requests. However, a significant concern arises from the output escaping, where only 54% of outputs are properly escaped, indicating a potential for cross-site scripting (XSS) vulnerabilities. Additionally, the taint analysis shows two flows with unsanitized paths, which, while not classified as critical or high severity, warrants attention as it suggests potential injection risks that were not fully mitigated.