Executive brief
The Flow Payment plugin for WordPress, which facilitates payment processing for online stores, contains a security flaw in how it handles order cancellations. An attacker can create a malicious link that, if clicked by a customer during checkout, executes unauthorized code in their web browser. This could allow an attacker to steal session information or perform actions on behalf of the user within the context of the website.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in the Flow Payment plugin for WordPress up to version 3.0.8. The flaw is located in flowpayment-fl.php (lines 57-58), where the 'error_message' GET parameter is passed directly to the wc_add_notice() function without proper sanitization or output escaping. An unauthenticated attacker can exploit this by crafting a URL with a malicious JavaScript payload in the error_message parameter. When a victim with an active WooCommerce session visits the link, the script executes in their browser. The issue is fixed in version 3.0.9.
Affected products
- Flow Flow Payment plugin for WordPress (flow.cl) <= 3.0.8
Timeline
- 2026-07-18: disclosed
- 2026-07-18: advisory