Skip to main content
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…

CVE-2026-57857: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Flow Flow Payment

0
Medium
VulnerabilityCVE-2026-57857cvecve-2026-57857cwe-79
Published: 07/18/2026 (07/18/2026, 20:33:06 UTC)
Source: CVE Database V5
Vendor/Project: Flow
Product: Flow Payment

Description

The Flow Payment plugin for WordPress (flow.cl) version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the error_message GET parameter is passed directly to wc_add_notice() in flowpayment-fl.php (lines 57-58) without input sanitization (for example sanitize_text_field()) or output escaping (for example esc_html()) before being rendered in the checkout notice HTML. An unauthenticated attacker can craft a URL containing a JavaScript payload in the error_message parameter (for example /checkout/?add-to-cart={product-id}&cancel_order=true&error_message={payload}); when a victim with an active WooCommerce checkout session follows the link, the payload executes in the victim's browser in the origin of the WordPress site.

CVSS v3.1

Score 4.3medium

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 07/18/2026, 20:56:44 UTC

Technical Analysis

CVE-2026-57857 is a reflected cross-site scripting vulnerability in the Flow Payment WordPress plugin (version 3.0.8). The vulnerability arises from improper neutralization of input in the error_message GET parameter, which is passed directly to the wc_add_notice() function without sanitization or escaping in flowpayment-fl.php (lines 57-58). This allows an unauthenticated attacker to inject JavaScript payloads that execute in the context of the WordPress site when a victim with an active WooCommerce checkout session visits a crafted URL containing the malicious error_message parameter.

Potential Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the vulnerable WordPress site for users on the WooCommerce checkout page. This can lead to theft of session cookies, redirection to malicious sites, or other actions performed with the victim's privileges in the browser. The vulnerability affects confidentiality and integrity but does not impact availability.

Mitigation Recommendations

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking on untrusted URLs containing the error_message parameter on the WooCommerce checkout page. Monitoring vendor channels for an official update or patch is recommended.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Data Version
5.2
Assigner Short Name
VulnCheck
Date Reserved
2026-06-25T18:48:00.282Z
Cvss Version
3.1
State
PUBLISHED
Remediation Level
null

Threat ID: 6a5be5372a4a8d5989425e99

Added to database: 07/18/2026, 20:42:31 UTC

Last enriched: 07/18/2026, 20:56:44 UTC

Last updated: 07/19/2026, 01:27:21 UTC

Views: 15

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses