CVE-2026-57857

Name of the Vulnerable Software and Affected Versions Flow Payment plugin for WordPress version 3.0.8

Description Reflected cross-site scripting occurs on the WooCommerce checkout page when the plugin handles order cancellations. The error message GET parameter is passed to the wc add notice() function in the flowpayment-fl.php file without proper input sanitization or output escaping. An unauthenticated attacker can craft a URL containing a JavaScript payload in the error message parameter; if a victim with an active WooCommerce checkout session follows the link, the payload executes in the victim's browser within the origin of the WordPress site.

Recommendations Update Flow Payment plugin for WordPress to a version newer than 3.0.8. As a temporary mitigation, avoid using the error message parameter in the checkout page until the plugin is updated.