CVE-2026-57857 Flow CVE debrief

Who should care

Users of the Flow Payment plugin for WordPress version 3.0.8 should be aware of this vulnerability and take steps to mitigate it. This includes applying the latest patch or update to a version that addresses this vulnerability, implementing input sanitization and output escaping for the error_message parameter, and monitoring for suspicious activity on the WooCommerce checkout page.

Technical summary

The Flow Payment plugin for WordPress version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the error_message GET parameter is passed directly to wc_add_notice() in flowpayment-fl.php (lines 57-58) without input sanitization or output escaping before being rendered in the checkout notice HTML. This allows an unauthenticated attacker to craft a URL containing a JavaScript payload in the error_message parameter.

Defensive priority

Medium priority due to CVSS score of 5.1 and potential impact on WooCommerce checkout page

Recommended defensive actions

• Apply the latest patch or update to a version that addresses this vulnerability
• Implement input sanitization and output escaping for the error_message parameter
• Monitor for suspicious activity on the WooCommerce checkout page
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence is limited, but the CVE record and NVD detail provide some information about the vulnerability. The CVE record was published on 2026-07-18T21:17:03.687Z and has not been modified since then. Defenders should verify the affected scope and severity based on the official advisory. The error_message GET parameter is passed directly to wc_add_notice() in flowpayment-fl.php (lines 57-58) without input sanitization or output escaping before being rendered in the checkout notice HTML.

Official resources