CVE-2026-57857

The Flow Payment plugin for WordPress (flow.cl) version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the error_message GET parameter is passed directly to wc_add_notice() in flowpayment-fl.php (lines 57-58) without input sanitization (for example sanitize_text_field()) or output escaping (for example esc_html()) before being rendered in the checkout notice HTML. An unauthenticated attacker can craft a URL containing a JavaScript payload in the error_message parameter (for example /checkout/?add-to-cart={product-id}&cancel_order=true&error_message={payload}); when a victim with an active WooCommerce checkout session follows the link, the payload executes in the victim's browser in the origin of the WordPress site.

• CWE-79

• https://www.flow.cl/
• https://www.vulncheck.com/advisories/flow-payment-plugin-for-wordpress-reflected-cross-site-scripting-via-error-message-parameter

Published

Jul 18, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5785Zohocorp ManageEngine PAM360 versions before 8531 and Manage…8.1
• CVE-2026-57850RustDesk before 1.4.9 does not enforce a session's authorize…8.7
• CVE-2026-57851MSI Feature Manager contains a local privilege escalation vu…8.5
• CVE-2026-57852Grav CMS scheduler-webhook plugin contains an authentication…6.3
• CVE-2026-57855Cockpit CMS contains a missing authorization vulnerability i…8.8
• CVE-2026-57856Cockpit CMS contains a path traversal vulnerability in the B…8.8
• CVE-2026-57858Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a store…8.9
• CVE-2026-57859e107 prior to version 2.3.8 contains a code execution vulner…7.7
• CVE-2026-5786An Improper Access Control vulnerability in Ivanti EPMM befo…8.8
• CVE-2026-57860ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI…7.8
• CVE-2026-57862Kanboard 1.2.52 and prior contains a server-side request for…8.5
• CVE-2026-57867MicroRealEstate allows adversaries to bypass authentication …8.8