CardCom Payment Gateway Security & Risk Analysis

The "woo-cardcom-payment-gateway" plugin v3.5.0.5 presents a mixed security posture. On the positive side, the static analysis shows no readily identifiable dangerous functions, all SQL queries utilize prepared statements, and there are no detected taint flows. The plugin also demonstrates some good security practices with the presence of nonce and capability checks.

However, significant concerns arise from the output escaping, where only 50% of outputs are properly escaped, leaving potential for Cross-Site Scripting (XSS) vulnerabilities. Furthermore, the plugin has a history of vulnerabilities, including one currently unpatched medium severity CVE. The fact that the last vulnerability was in September 2025 and remains unpatched is a critical red flag, indicating a lack of ongoing maintenance and a potential for exploit. The presence of external HTTP requests without further context also warrants caution.

While the plugin's attack surface appears minimal and it employs some security controls, the unpatched vulnerability and insufficient output escaping significantly lower its overall security standing. Users should exercise extreme caution and prioritize updating or seeking alternative solutions if a patch is not promptly released.