CVE-2026-57857: Flow Payment WordPress Plugin XSS Flaw

CVE-2026-57857 Overview

CVE-2026-57857 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in the Flow Payment plugin for WordPress (flow.cl) version 3.0.8. The flaw resides in the WooCommerce checkout page order cancellation handler. The plugin passes the error_message GET parameter directly to wc_add_notice() in flowpayment-fl.php (lines 57-58) without input sanitization or output escaping. An unauthenticated attacker can craft a malicious link that executes arbitrary JavaScript in a victim's browser under the origin of the WordPress site.

Critical Impact
Successful exploitation runs attacker-controlled JavaScript in the victim's browser session on the WordPress site, enabling session theft, credential harvesting, and checkout tampering.

Affected Products

Flow Payment plugin for WordPress (flow.cl) version 3.0.8
WordPress sites running WooCommerce with the Flow Payment integration enabled
Checkout pages exposed to unauthenticated visitors

Discovery Timeline

2026-07-18 - CVE-2026-57857 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-57857

Vulnerability Analysis

The vulnerability is a classic reflected XSS in the checkout flow. When a shopper cancels an order, the plugin reads the error_message parameter from the query string and forwards its raw value to WooCommerce's wc_add_notice() function. WooCommerce renders notices as HTML on the checkout page, so any script content in the parameter is emitted verbatim into the response.

Because the sink is reached during a normal checkout GET request, no authentication, no CSRF token, and no prior session state are required from the attacker. The victim only needs an active WooCommerce checkout session and must click the crafted link. The EPSS probability for exploitation is currently 0.224%.

Root Cause

The plugin omits both input sanitization (sanitize_text_field()) and output escaping (esc_html() or esc_attr()) on the error_message parameter. WordPress and WooCommerce provide these primitives specifically for user-controlled data reaching HTML sinks, but the Flow Payment cancellation handler bypasses them and trusts the query string directly.

Attack Vector

An attacker delivers a URL of the form /checkout/?add-to-cart={product-id}&cancel_order=true&error_message={payload} to the victim via phishing, forum posts, or malvertising. When the victim loads the URL, the payload is echoed into the checkout notice markup. The script executes in the origin of the vulnerable WordPress site, giving the attacker access to cookies not marked HttpOnly, DOM data, and the ability to submit forms as the victim.

The vulnerability requires user interaction (clicking the crafted link) but no privileges. See the VulnCheck Security Advisory for the reproduction path.

Detection Methods for CVE-2026-57857

Indicators of Compromise

Web server access logs containing cancel_order=true combined with error_message= values that include <, >, script, onerror, javascript:, or URL-encoded equivalents (%3C, %3E).
Referrer values from external domains pointing to /checkout/ with populated error_message parameters.
Browser console errors or CSP report-uri submissions originating from the checkout page.

Detection Strategies

Deploy WAF rules that block or flag requests to WooCommerce checkout endpoints containing HTML/JavaScript metacharacters in error_message.
Add static code inspection for calls to wc_add_notice() that pass unsanitized $_GET or $_REQUEST data.
Enable Content Security Policy (CSP) in report-only mode on checkout pages to surface unexpected inline script execution.

Monitoring Recommendations

Alert on spikes of 4xx/5xx responses or unusual query-string lengths against /checkout/ URLs.
Correlate suspicious error_message requests with subsequent authentication or payment events from the same client IP or session.
Track outbound requests from checkout sessions to unrecognized domains, which may indicate data exfiltration by injected scripts.

How to Mitigate CVE-2026-57857

Immediate Actions Required

Disable the Flow Payment plugin on WordPress sites running version 3.0.8 until a fixed release is installed.
Apply a WAF virtual patch that rejects checkout requests where error_message contains HTML or script tokens.
Audit checkout logs for prior exploitation attempts and rotate any session cookies or admin credentials that may have been exposed.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry. Site operators should monitor the Flow website and the VulnCheck Security Advisory for an updated plugin release, and upgrade as soon as a fix beyond version 3.0.8 becomes available.

Workarounds

Wrap the plugin's cancellation handler with a mu-plugin filter that applies sanitize_text_field() to $_GET['error_message'] before it reaches wc_add_notice().
Enforce a strict Content Security Policy on the checkout page that disallows inline scripts (script-src 'self').
Set session and authentication cookies with HttpOnly and SameSite=Lax or stricter to reduce theft impact if the payload fires.

bash

# Example nginx rule to block obvious XSS payloads on the checkout endpoint
location /checkout/ {
    if ($arg_error_message ~* "(<|>|script|onerror|javascript:|%3C|%3E)") {
        return 403;
    }
    try_files $uri $uri/ /index.php?$args;
}