WP Manifestindependent plugin directory
manifest / ecommerce / wp-pronamic-pay-adyen

Pronamic Pay Adyen Add-On WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

Adyen driver for the WordPress payment processing library.

★ 7stars
81release downloads
33kcomposer installs
v4.10.0latest · 2mo ago

Install

Download pronamic-pay-adyen.4.10.0.zip From the v4.10.0 release on GitHub, Jul 31, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/pronamic/wp-pronamic-pay-adyen/releases/download/v4.10.0/pronamic-pay-adyen.4.10.0.zip

On Packagist as wp-pay-gateways/adyen:

composer require wp-pay-gateways/adyen
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

WordPress Pay Gateway: Adyen

Adyen driver for the WordPress payment processing library.

Built with Grunt

Adyen Notifications (webhooks)

The Pronamic Pay Adyen gateway can handle Adyen notifications via the WordPress REST API.

Route: /wp-json/pronamic-pay/adyen/v1/notifications

The WordPress REST API Adyen notifications endpoint can be tested with for example cURL:

curl --request POST --user username:password http://pay.test/wp-json/pronamic-pay/adyen/v1/notifications

WordPress Filters

pronamic_pay_adyen_checkout_head

add_action( 'pronamic_pay_adyen_checkout_head', 'custom_adyen_checkout_head', 15 );

function custom_adyen_checkout_head() {
    wp_register_style(
        'custom-adyen-checkout-style',
        get_stylesheet_directory_uri() . '/css/adyen-checkout.css',
        array(),
        '1.0.0'
    );

    wp_print_styles( 'custom-adyen-checkout-style' );
}

pronamic_pay_adyen_config_object

add_filter( 'pronamic_pay_adyen_config_object', 'custom_adyen_config_object', 15 );

function custom_adyen_config_object( $config_object ) {
    $style_object = (object) array(
        'base'        => (object) array(
            'color'         => '#000',
            'fontSize'      => '14px',
            'lineHeight'    => '14px',
            'fontSmoothing' => 'antialiased',
        ),
        'error'       => (object) array(
            'color' => 'red',
        ),
        'placeholder' => (object) array(
            'color' => '#d8d8d8',
        ),
        'validated'   => (object) array(
            'color' => 'green',
        ),
    );

    $config_object->paymentMethods = (object) array(
        'card' => (object) array(
            'sfStyles' => $style_object,
        ),
    );

    return $config_object;
}

Production Environment

Dashboard URL: https://ca-live.adyen.com/
API URL: https://{LIVE_API_URL_PREFIX}-checkout-live.adyenpayments.com/checkout/v41/

Test Environment

Dashboard URL: https://ca-test.adyen.com/
API URL: https://checkout-test.adyen.com/v41/

Frequently Asked Questions

Why do I get the "Unable to instantiate the payment screen" notice?

Adyen says on August 12, 2019:

The "Unable to instantiate the payment screen" appears when Adyen doesn't have any available payment methods to display in our SDK.

Bancontact is exclusive to Belgium and I can see you in /paymentSession​ request, you set "countryCode" : "NL"​. Could you try setting this to BE​, then you should be able to see BCMC.

License

Releases

Newest 25 of 31 recorded releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v4.10.0 latest
Jul 31, 2026 2mo ago
pronamic-pay-adyen.4.10.0.zip
7
Jan 5, 2026 9mo ago
pronamic-pay-adyen.4.9.0.zip
4
Nov 11, 2025 11mo ago
pronamic-pay-adyen.4.8.0.zip
3
Oct 6, 2025 1 year ago
pronamic-pay-adyen.4.8.0-rc.1.zip
7
Aug 22, 2025 1 year ago
pronamic-pay-adyen.4.7.0.zip
5
Jun 19, 2025 1 year ago
pronamic-pay-adyen.4.6.1.zip
2
Jun 19, 2025 1 year ago
pronamic-pay-adyen.4.6.0.zip
1
Dec 17, 2024 1 year ago
pronamic-pay-adyen.4.5.2.zip
3
Mar 26, 2024 2 years ago
pronamic-pay-adyen.4.5.1.zip
5
Feb 7, 2024 2 years ago
pronamic-pay-adyen.4.5.0.zip
4
Oct 13, 2023 3 years ago
pronamic-pay-adyen.4.4.7.zip
6
Jul 12, 2023 3 years ago
tag only
—
Jun 1, 2023 3 years ago
tag only
—
Mar 27, 2023 3 years ago
tag only
—
Feb 15, 2023 3 years ago
tag only
—
Feb 3, 2023 3 years ago
tag only
—
Jan 31, 2023 3 years ago
tag only
—
Dec 20, 2022 3 years ago
tag only
—
Nov 29, 2022 3 years ago
tag only
—
Nov 7, 2022 3 years ago
pronamic-pay-adyen.4.3.0.zip
2
Sep 27, 2022 4 years ago
pronamic-pay-adyen.4.2.2.zip
4
Sep 27, 2022 4 years ago
tag only
—
May 30, 2022 4 years ago
pronamic-pay-adyen.4.0.0.zip
18
May 25, 2022 4 years ago
pronamic-pay-adyen.4.0.0-RC-2.zip
3
May 12, 2022 4 years ago
pronamic-pay-adyen.4.0.0-RC-1.zip
4
All releases on GitHub →
C- grade

Security

Pronamic Pay Adyen Add-On 4.10.0 · audited by WP Registry

High-severity findings.

1 high
Audited release
4.10.0
Findings
1
Worst severity
high
Content hash
91de0eed5ad5c52718273ba3…

Findings

  • high Stored XSS in admin payment notes via webhook JSON and error REST params

    xss_stored

    Payment notes are stored with wp_insert_comment (no kses) and printed in wp-admin via comment_text() in vendor/wp-pay/core/views/meta-box-notes.php, which does not escape HTML. NotificationsController concatenates wp_json_encode($item->get_json()) into <pre> without esc_html; JSON string fields such as pspReference can contain </pre><script>… (json_encode does not use JSON_HEX_TAG). That write is unauthenticated when webhook basic auth is unset. Independently, GET /error/{payment_id} (nonce from the drop-in page, no capability) interpolates attacker-controlled name and message query args into <p>/<blockquote> HTML and add_note(); GET /redirect/{id} interpolates resultCode into a note the same way. A guest completing checkout, or anyone who can POST a notification for a known payment id, plants script that runs when a merchant with edit_payments opens the payment. That is admin-session XSS (privilege escalation to the merchant account), not a front-end echo.

    src/ReturnController.php:397-421

    Recommendation

    Escape every untrusted fragment with esc_html before concatenating note HTML (error name/message, resultCode, webhook JSON). Prefer wp_json_encode(..., JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT) and still escape on output. Keep comment_text() only for already-sanitized HTML, or switch the meta box to esc_html/wp_kses with an explicit allowlist.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.