CVE-2026-57857: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Flow Flow Payment
The Flow Payment plugin for WordPress (flow.cl) version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the error_message GET parameter is passed directly to wc_add_notice() in flowpayment-fl.php (lines 57-58) without input sanitization (for example sanitize_text_field()) or output escaping (for example esc_html()) before being rendered in the checkout notice HTML. An unauthenticated attacker can craft a URL containing a JavaScript payload in the error_message parameter (for example /checkout/?add-to-cart={product-id}&cancel_order=true&error_message={payload}); when a victim with an active WooCommerce checkout session follows the link, the payload executes in the victim's browser in the origin of the WordPress site.
AI Analysis
Technical Summary
CVE-2026-57857 is a reflected cross-site scripting vulnerability in the Flow Payment WordPress plugin (version 3.0.8). The vulnerability arises from improper neutralization of input in the error_message GET parameter, which is passed directly to the wc_add_notice() function without sanitization or escaping in flowpayment-fl.php (lines 57-58). This allows an unauthenticated attacker to inject JavaScript payloads that execute in the context of the WordPress site when a victim with an active WooCommerce checkout session visits a crafted URL containing the malicious error_message parameter.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the vulnerable WordPress site for users on the WooCommerce checkout page. This can lead to theft of session cookies, redirection to malicious sites, or other actions performed with the victim's privileges in the browser. The vulnerability affects confidentiality and integrity but does not impact availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking on untrusted URLs containing the error_message parameter on the WooCommerce checkout page. Monitoring vendor channels for an official update or patch is recommended.
CVE-2026-57857: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Flow Flow Payment
Description
The Flow Payment plugin for WordPress (flow.cl) version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the error_message GET parameter is passed directly to wc_add_notice() in flowpayment-fl.php (lines 57-58) without input sanitization (for example sanitize_text_field()) or output escaping (for example esc_html()) before being rendered in the checkout notice HTML. An unauthenticated attacker can craft a URL containing a JavaScript payload in the error_message parameter (for example /checkout/?add-to-cart={product-id}&cancel_order=true&error_message={payload}); when a victim with an active WooCommerce checkout session follows the link, the payload executes in the victim's browser in the origin of the WordPress site.
CVSS v3.1
Score 4.3medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-57857 is a reflected cross-site scripting vulnerability in the Flow Payment WordPress plugin (version 3.0.8). The vulnerability arises from improper neutralization of input in the error_message GET parameter, which is passed directly to the wc_add_notice() function without sanitization or escaping in flowpayment-fl.php (lines 57-58). This allows an unauthenticated attacker to inject JavaScript payloads that execute in the context of the WordPress site when a victim with an active WooCommerce checkout session visits a crafted URL containing the malicious error_message parameter.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the vulnerable WordPress site for users on the WooCommerce checkout page. This can lead to theft of session cookies, redirection to malicious sites, or other actions performed with the victim's privileges in the browser. The vulnerability affects confidentiality and integrity but does not impact availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking on untrusted URLs containing the error_message parameter on the WooCommerce checkout page. Monitoring vendor channels for an official update or patch is recommended.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-06-25T18:48:00.282Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5be5372a4a8d5989425e99
Added to database: 07/18/2026, 20:42:31 UTC
Last enriched: 07/18/2026, 20:56:44 UTC
Last updated: 07/19/2026, 01:27:21 UTC
Views: 15
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.