Flow Payment
CVE-2026-57857
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Crafted URL exploitable over network with no attacker privileges (PR:N); victim must click link (UI:R); payload executes in WordPress browser origin causing scope change (S:C) with limited data and DOM impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
The Flow Payment plugin for WordPress (flow.cl) version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the error_message GET parameter is passed directly to wc_add_notice() in flowpayment-fl.php (lines 57-58) without input sanitization (for example sanitize_text_field()) or output escaping (for example esc_html()) before being rendered in the checkout notice HTML. An unauthenticated attacker can craft a URL containing a JavaScript payload in the error_message parameter (for example /checkout/?add-to-cart={product-id}&cancel_order=true&error_message={payload}); when a victim with an active WooCommerce checkout session follows the link, the payload executes in the victim's browser in the origin of the WordPress site.
AnalysisAI
Reflected XSS in the Flow Payment WordPress plugin version 3.0.8 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by embedding a payload in the error_message GET parameter of the WooCommerce order cancellation URL. The plugin's cancellation handler in flowpayment-fl.php passes this parameter directly to wc_add_notice() without sanitization or output escaping, rendering attacker-controlled content as HTML in the checkout page. No public exploit code has been identified at time of analysis, but the attack is trivially constructable from the fully disclosed parameter name and code path published in the VulnCheck advisory.
Technical ContextAI
The affected component is the Flow Payment plugin (CPE: cpe:2.3:a:flow:flow_payment:*:*:*:*:*:*:*:*) - a WooCommerce payment integration for the Chilean gateway flow.cl. At flowpayment-fl.php lines 57-58, the plugin's order cancellation callback reads the error_message GET parameter and passes it unsanitized directly to wc_add_notice(), a WooCommerce function that renders user-facing notices inside the checkout page HTML. Neither WordPress input sanitization (sanitize_text_field() or wp_unslash()) nor output escaping (esc_html() or esc_attr()) is applied at any point in the data flow. This is a canonical CWE-79 (Improper Neutralization of Input During Web Page Generation) reflected XSS: user-supplied input is reflected into an HTML context in the same HTTP response cycle without encoding, enabling script injection scoped to the WordPress site's origin. The scope change in the CVSS vector (S:C) reflects that the payload executes under the WordPress origin in the victim's browser, crossing the boundary from the plugin's component into the broader browser session context.
RemediationAI
No vendor-released patch has been identified at time of analysis - neither the flow.cl vendor site nor the VulnCheck advisory references a fixed plugin version. Site administrators should consider temporarily deactivating the Flow Payment plugin until an updated version is available, accepting the trade-off of losing checkout payment functionality in exchange for eliminating the XSS exposure. As a compensating control without disabling the plugin, deploying a WAF rule that rejects or strips HTML tags and JavaScript event handlers (script, onerror=, onload=, javascript: schemes) from the error_message parameter on requests matching /checkout/?cancel_order=true can reduce exploitation risk; note that aggressive WAF rules may cause false positives if legitimate gateway error messages include special characters. Developers with direct plugin file access can apply a minimal source-level fix: replace the raw $_GET['error_message'] read at flowpayment-fl.php lines 57-58 with sanitize_text_field(wp_unslash($_GET['error_message'])) for input sanitization, and ensure the value passed to wc_add_notice() is escaped with esc_html() before any HTML rendering. Monitor the WordPress plugin repository and https://www.flow.cl/ for an official patched release. Reference: https://www.vulncheck.com/advisories/flow-payment-plugin-for-wordpress-reflected-cross-site-scripting-via-error-message-parameter.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today