Description
The Flow Payment plugin for WordPress (flow.cl) version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the error_message GET parameter is passed directly to wc_add_notice() in flowpayment-fl.php (lines 57-58) without input sanitization (for example sanitize_text_field()) or output escaping (for example esc_html()) before being rendered in the checkout notice HTML. An unauthenticated attacker can craft a URL containing a JavaScript payload in the error_message parameter (for example /checkout/?add-to-cart={product-id}&cancel_order=true&error_message={payload}); when a victim with an active WooCommerce checkout session follows the link, the payload executes in the victim's browser in the origin of the WordPress site.
Published: 2026-07-18
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Flow Payment plugin for WordPress releases a reflected XSS flaw on the WooCommerce checkout page. When canceling an order, the plugin passes the error_message GET parameter directly to the WooCommerce notice API without sanitizing or escaping it. An unauthenticated attacker can therefore embed JavaScript in the parameter, causing the script to execute in the browser of any user viewing the checkout page. Such a payload can steal session cookies, perform actions as the user, or deface the site. This weakness is classified as CWE‑79.

Affected Systems

This issue affects the Flow Payment plugin for WordPress version 3.0.8. The vulnerability is present on any WordPress installation that runs that plugin with WooCommerce enabled. No other product versions or vendors are listed.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity, with an exploitation probability of less than 1% according to EPSS. The vulnerability is not present in the CISA KEV list, suggesting no active exploitation is known. The attack vector is a crafted URL that includes a malicious payload in the error_message parameter, which a victim must click while maintaining an active checkout session. Because the flaw is reflected and requires user interaction, the overall risk is moderate but the low EPSS score reflects a comparatively low likelihood of exploitation.

Generated by OpenCVE AI on July 30, 2026 at 22:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Flow Payment plugin to the latest release that removes the unescaped error_message issue.
  • If an upgrade is not immediately possible, alter the plugin's flowpayment-fl.php file to sanitize the error_message parameter with sanitize_text_field() before calling wc_add_notice().
  • As a temporary measure, temporarily disable the cancel_order functionality or restrict it to authenticated users so that the vulnerable path cannot be triggered by unauthenticated requests.

Generated by OpenCVE AI on July 30, 2026 at 22:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Flow
Flow flow Payment
Wordpress
Wordpress wordpress
Vendors & Products Flow
Flow flow Payment
Wordpress
Wordpress wordpress

Mon, 20 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 18 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 7.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N'}

 cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Sat, 18 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
Description The Flow Payment plugin for WordPress (flow.cl) version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the error_message GET parameter is passed directly to wc_add_notice() in flowpayment-fl.php (lines 57-58) without input sanitization (for example sanitize_text_field()) or output escaping (for example esc_html()) before being rendered in the checkout notice HTML. An unauthenticated attacker can craft a URL containing a JavaScript payload in the error_message parameter (for example /checkout/?add-to-cart={product-id}&cancel_order=true&error_message={payload}); when a victim with an active WooCommerce checkout session follows the link, the payload executes in the victim's browser in the origin of the WordPress site.
Title Flow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 7.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N'}

Subscriptions

Flow Flow Payment
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-20T17:45:54.451Z

Reserved: 2026-06-25T18:48:00.282Z

Link: CVE-2026-57857

cve-icon Vulnrichment

Updated: 2026-07-20T15:10:24.834Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T23:00:22Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')