Zoho Billing – Embed Payment Form Security & Risk Analysis

The zoho-subscriptions plugin version 4.1 exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices regarding SQL queries, exclusively using prepared statements, and has a low number of entry points with zero identified as unprotected. The static analysis also shows a good rate of output escaping and the presence of a nonce check. However, the complete absence of capability checks is a significant concern, suggesting that access control might be improperly implemented, potentially leaving features vulnerable to unauthorized use. Additionally, the plugin has a history of two known CVEs, one of which remains unpatched. Both historical vulnerabilities were classified as medium severity and related to Cross-site Scripting, indicating a recurring pattern of input sanitization issues.