Skip to content
OpenAdvisories

Vendor

Flow

2 known vulnerabilities.

Products

flow-server 1 Flow Payment 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 4.3
    CVE-2026-57857

    Flow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter

    The Flow Payment plugin for WordPress (flow.cl) version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the error_message GET parameter is passed directly to wc_add_notice(…

    Flow Flow Payment Web / CMS