Flow Payment cancellation messages can execute script in checkout
Flow Payment 3.0.8 and earlier reflects its cancellation error_message into the WooCommerce checkout notice without safely escaping it. An attacker can place script in a crafted cancellation link; if a shopper with an active checkout follows that link, the script runs as part of the store. This is a reflected XSS issue rather than a server takeover, but it can still be used to alter checkout content or steal browser-accessible data.
- Component
- Flow Payment
- Plugin slug
flow-payment- Affected
- <= 3.0.8
- Safe version
3.0.9- Published
- Jul 18, 2026
This CVE was published Jul 18, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update Flow Payment to 3.0.9 or later.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Flow Payment plugin for WordPress (flow.cl) version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the error_message GET parameter is passed directly to wc_add_notice() in flowpayment-fl.php (lines 57-58) without input sanitization (for example sanitize_text_field()) or output escaping (for example esc_html()) before being rendered in the checkout notice HTML. An unauthenticated attacker can craft a URL containing a JavaScript payload in the error_message parameter (for example /checkout/?add-to-cart={product-id}&cancel_order=true&error_message={payload}); when a victim with an active WooCommerce checkout session follows the link, the payload executes in the victim's browser in the origin of the WordPress site.
CVE / CNA vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X