PCI compliance will always be an issue when dealing with credit card payments. Doing it this way only complicates things as now not only does your site have to be PCI compliant but so does the user who uses this widget. PCI compliance dictates that any website that handles credit card payments must be PCI compliant. So by having the payment functionality in a widget you forces your users to be PCI compliant as well.

One issue that may be difficult to overcome is SSL. You can perform the entire transaction over SSL using your widget but the user won't know that because the browser will not show that the page is secure unless the page that the widget is on is using SSL itself. So users may abandon a purchase if they don't see the lock icon in the browser.

PCI compliance will always be an issue when dealing with credit card payments. Doing it this way only complicates things as now not only does your site have to be PCI compliant but so does the user who uses this widget. PCI compliance dictates that any website that handles credit card payments must be PCI compliant.

The Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements designed to ensure that ALL companies that process, store or transmit credit card information maintain a secure environment. (source)

So by having the payment functionality in a widget you forces your users to be PCI compliant as well.

One issue that may be difficult to overcome is SSL. You can perform the entire transaction over SSL using your widget but the user won't know that because the browser will not show that the page is secure unless the page that the widget is on is using SSL itself. So users may abandon a purchase if they don't see the lock icon in the browser.