Skip to content
BackEsc
Sign in

Shopify · disclosed reports

Cross-site Scripting

127 disclosed reports · $83,350 paid

Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.

Open Shopify on HackerOne
reports
127
paid a bounty
62

Every one of the 127 is a mark on the map. Named now: 1 to 26, most upvoted first.

  1. XSS while logging using Google#691611Shopify · $1,750 · 341 votes
  2. Stored XSS in my staff name fired in another your internal panel#946053Shopify · 326 votes
  3. XSS at jamfpro.shopifycloud.com#1444682Shopify · $9,400 · 240 votes
  4. H1514 DOMXSS on Embedded SDK via Shopify.API.setWindowLocation abusing cookie Stuffing#422043Shopify · 195 votes
  5. XSS at https://exchangemarketplace.com/blogsearch#1145162Shopify · 174 votes
  6. XSS in www.shopify.com/markets?utm_source=#1699762Shopify · 159 votes
  7. Stored XSS in SVG file as data: url#1276742Shopify · $5,300 · 153 votes
  8. Reflected XSS In Marketing Reports Page On *.myshopify.com/admin#1754843Shopify · 128 votes
  9. Stored XSS in private message#729424Shopify · $1,000 · 124 votes
  10. XSS on any Shopify shop via abuse of the HTML5 structured clone algorithm in postMessage listener on "/:id/digital_wallets/dialog"#231053Shopify · $3,000 · 121 votes
  11. Reflected XSS on help.shopify.com#1940245Shopify · $500 · 111 votes
  12. Reflected XSS in AI Chat Bot Greetings at help.shopify.com via Markdown Image Rendering#2509022Shopify · $1,600 · 110 votes
  13. Stored XSS in Shopify Chat#756729Shopify · $500 · 106 votes
  14. Reflected XSS in *.myshopify.com/account/register#470206Shopify · 104 votes
  15. Reflected XSS online-store-git.shopifycloud.com#1410459Shopify · $3,500 · 98 votes
  16. XSS on $shop$.myshopify.com/admin/ and partners.shopify.com via whitelist bypass in SVG icon for sales channel applications#232174Shopify · $5,000 · 88 votes
  17. Reflective Cross-site Scripting via Newsletter Form#709336Shopify · $2,000 · 79 votes
  18. Stored XSS in /admin/product and /admin/collections#1147433Shopify · $5,300 · 76 votes
  19. ██████ DOM XSS via Shopify.API.remoteRedirect#646505Shopify · 76 votes
  20. xss stored#798599Shopify · 75 votes
  21. Stored XSS in Discounts section#618031Shopify · $1,000 · 75 votes
  22. Blind Stored XSS in shopify internal Parquet Viewer#1103298Shopify · 74 votes
  23. help.shopify.com Cross Site Scripting#564196Shopify · 71 votes
  24. xss is triggered on your web#1121900Shopify · 69 votes
  25. POST-based XSS on apps.shopify.com#429679Shopify · $500 · 69 votes
  26. Reflected XSS in <any>.myshopify.com through theme preview#226428Shopify · 69 votes

paid a bounty

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in