Starbucks · disclosed reports
Cross-site Scripting
27 disclosed reports · $0 paid · 27 valid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open Starbucks on HackerOne- reports
- 27
- valid
- 27
- paid a bounty
- 0
Every one of the 27 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Reflected Cross site Scripting (XSS) on www.starbucks.com
- Cross-Site Scripting (XSS) on www.starbucks.com | .co.uk login pages
- Reflected cross-site scripting on multiple Starbucks assets.
- Reflected XSS in https://www.starbucks.co.jp/store/search/
- Singapore - Unrestricted File Upload Leads to XSS on campaign.starbucks.com.sg/api/upload
- WAF bypass via double encoded non standard ASCII chars permitted a reflected XSS on response page not found pages - (629745 bypass)
- Reflected XSS in https://www.starbucks.com/account/create/redeem/MCP131XSR via xtl_amount, xtl_coupon_code, xtl_amount_type parameters
- Stored XSS on www.starbucks.com.sg/careers/career-center/career-landing-*
- www.starbucks.co.uk Reflected XSS via utm_source parameter
- Persistent XSS in www.starbucks.com
- DOM XSS on app.starbucks.com via ReturnUrl
- XSS on https://www.starbucks.co.uk (can lead to credit card theft) (/shop/paymentmethod)
- [stagecafrstore.starbucks.com] CRLF Injection, XSS
- Reflected XSS by exploiting CSRF vulnerability on teavana.com wishlist comment module. (wishlist-comments)
- Stored XSS in comments on https://www.starbucks.co.uk/blog/*
- Open redirect / Reflected XSS payload in root that affects all your sites (store.starbucks.* / shop.starbucks.* / teavana.com)
- DOM-based XSS in store.starbucks.co.uk on IE 11
- DOM XSS on teavana.com via "pr_zip_location" parameter
- Reflected XSS on teavana.com (Locale-Change)
- Dom Based Xss DIV.innerHTML parameters store.starbucks*
- Reflected DOM XSS on www.starbucks.co.uk
- Reflected XSS on https://www.starbucks.co.uk/shop/paymentmethod/ (bypass for 227486)
- Reflected XSS in openapi.starbucks.com /searchasyoutype/v1/search?x-api-key=
- Stored XSS in Adress Book (starbucks.com/account/profile)
- Korea - Reflected XSS on https://www.istarbucks.co.kr/app/getGiftStock.do via "skuNo" and "skuImgUrl" parameters
- Reflected XSS on card.starbucks.com.sg/unsub.php via the 'ct' Parameter
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.