CVE-2026-57857 is a reflected cross-site scripting vulnerability in the Flow Payment plugin for WordPress (version 3.0.8). The issue occurs on the WooCommerce checkout page when handling order cancellations. Specifically, the error_message GET parameter is passed directly to the wc_add_notice() function in flowpayment-fl.php without proper input sanitization or output escaping. An unauthenticated attacker can craft a URL containing malicious JavaScript in the error_message parameter, which executes in the victim's browser if they have an active WooCommerce checkout session and visit the crafted URL. This vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 4.3 (medium severity). No official patch or remediation guidance is currently available.

An attacker can execute arbitrary JavaScript in the context of the affected WordPress site by tricking a user with an active WooCommerce checkout session into visiting a specially crafted URL. This reflected XSS vulnerability can lead to limited confidentiality impact (such as theft of session cookies or other information accessible via JavaScript). There is no indication of integrity or availability impact. The attack requires user interaction and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking suspicious URLs containing the error_message parameter on affected sites. Site administrators may consider applying custom input sanitization or output escaping in the plugin code as a temporary mitigation. Monitor official Flow Payment plugin updates for an official fix.