PT-2026-60989 · WordPress · Flow Payment

Matias Schiappacasse + 1 · CVE-2026-57857 · Published 2026-07-18 · Updated 2026-07-18

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Flow Payment plugin for WordPress version 3.0.8

Description Reflected cross-site scripting occurs on the WooCommerce checkout page when the plugin handles order cancellations. The error message GET parameter is passed to the wc add notice() function in the flowpayment-fl.php file without proper input sanitization or output escaping. An unauthenticated attacker can craft a URL containing a JavaScript payload in the error message parameter; if a victim with an active WooCommerce checkout session follows the link, the payload executes in the victim's browser within the origin of the WordPress site.

Recommendations Update Flow Payment plugin for WordPress to a version newer than 3.0.8. As a temporary mitigation, avoid using the error message parameter in the checkout page until the plugin is updated.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-57857

Affected Products

Flow Payment

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-57857 · Security Note
• https://twitter.com/CVEnew/status/2078618655697273043 · Twitter Post
• https://vulncheck.com/advisories/flow-payment-plugin-for-wordpress-reflected-cross-site-scripting-via-error-message-parameter · Note
• https://flow.cl · Note
• https://twitter.com/infoflowcloud/status/2078619881662980547 · Twitter Post