Flow Payment
Monthly
Reflected XSS in the Flow Payment WordPress plugin version 3.0.8 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by embedding a payload in the error_message GET parameter of the WooCommerce order cancellation URL. The plugin's cancellation handler in flowpayment-fl.php passes this parameter directly to wc_add_notice() without sanitization or output escaping, rendering attacker-controlled content as HTML in the checkout page. No public exploit code has been identified at time of analysis, but the attack is trivially constructable from the fully disclosed parameter name and code path published in the VulnCheck advisory.
Reflected XSS in the Flow Payment WordPress plugin version 3.0.8 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by embedding a payload in the error_message GET parameter of the WooCommerce order cancellation URL. The plugin's cancellation handler in flowpayment-fl.php passes this parameter directly to wc_add_notice() without sanitization or output escaping, rendering attacker-controlled content as HTML in the checkout page. No public exploit code has been identified at time of analysis, but the attack is trivially constructable from the fully disclosed parameter name and code path published in the VulnCheck advisory.