Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| many xss in widgets.shopifyapps.com#105659 | Valid | Cross-site Scripting | – | 2016-02-04 | $500 | 1 |
| www.shopify.com XSS via third-party script#111475 | Valid | Cross-site Scripting | – | 2016-02-01 | $500 | 1 |
| XSS on hardware.shopify.com#116006 | Valid | Cross-site Scripting | – | 2016-03-01 | $500 | 1 |
| xss in the all widgets of shopifyapps.com#119250 | Valid | Cross-site Scripting | – | 2016-03-16 | $500 | 1 |
| Stored XSS via "Free Shipping" option (Discounts)#124429 | Valid | Cross-site Scripting | – | 2016-04-05 | $500 | 1 |
| XSS on ecommerce.shopify.com#56779 | Valid | Cross-site Scripting | – | 2015-09-06 | – | 2 |
| Bulk Discount App in myshopify.com exposes http://bulkdiscounts.shopifyapps.com vulnerable to XSS#62861 | Valid | Cross-site Scripting | – | 2015-07-23 | – | 2 |
| XSS in Myshopify Admin Site in DISCOUNTS#71614 | Valid | Cross-site Scripting | – | 2015-07-20 | – | 2 |
| XSS at Bulk editing ProductVariants#72331 | Valid | Cross-site Scripting | – | 2015-06-25 | $500 | 2 |
| Reflected XSS in chat#73566 | Valid | Cross-site Scripting | – | 2015-08-11 | – | 2 |
| XSS https://www.shopify.com/signup#85291 | Valid | Cross-site Scripting | – | 2015-08-31 | $500 | 2 |
| www.shopify.com XSS on blog pages via sharing buttons#87168 | Valid | Cross-site Scripting | – | 2015-10-21 | $500 | 2 |
| Stored XSS in /admin/orders#106897 | Valid | Cross-site Scripting | – | 2016-02-17 | – | 2 |
| Stored XSS in https://checkout.shopify.com/#122849 | Valid | Cross-site Scripting | – | 2016-03-15 | $500 | 2 |
| XSS on https://app.shopify.com/#126539 | Valid | Cross-site Scripting | – | 2016-04-05 | $500 | 2 |
| XSS on support.shopify.com#56760 | Valid | Cross-site Scripting | – | 2015-06-09 | – | 3 |
| XSS at importing Product List#67125 | Valid | Cross-site Scripting | – | 2015-06-17 | $500 | 3 |
| XSS at Bulk editing products#67132 | Valid | Cross-site Scripting | – | 2015-06-17 | $500 | 3 |
| XSS https://delivery.shopifyapps.com/ (Digital Downloads App in myshopify.com)#81441 | Valid | Cross-site Scripting | – | 2015-08-24 | – | 3 |
| XSS in creating tweets#101450 | Valid | Cross-site Scripting | – | 2015-12-03 | – | 3 |
| [persistent cross-site scripting] customers can target admins#55842 | Valid | Cross-site Scripting | – | 2015-07-01 | – | 4 |
| XSS - URL Redirects#56662 | Informative | Cross-site Scripting | None | 2015-05-16 | – | 4 |
| XSS in myshopify.com Admin site in TAX Overrides#62427 | Valid | Cross-site Scripting | – | 2015-06-09 | – | 4 |
| Reflected XSS in chat.#81757 | Valid | Cross-site Scripting | – | 2015-09-02 | – | 4 |
| Strored Cross Site Scripting#106636 | Valid | Cross-site Scripting | – | 2016-03-13 | $500 | 4 |
| Xss in website's link#54321 | Valid | Cross-site Scripting | – | 2015-05-13 | – | 5 |
| XSS on hardware.shopify.com#123125 | Valid | Cross-site Scripting | – | 2016-04-09 | – | 5 |
| XSS in my.shopify.com in widget#185826 | Valid | Cross-site Scripting | Medium | 2017-07-21 | $500 | 5 |
| xss on polaris.shopify.com/demo using postMessage#894518 | Valid | Cross-site Scripting | Low | 2021-02-11 | – | 5 |
| Stored XSS in the Shopify Discussion Forums#59015 | Valid | Cross-site Scripting | – | 2015-05-31 | $500 | 6 |
| XSS in experts.shopify.com#57459 | Valid | Cross-site Scripting | – | 2015-05-19 | – | 7 |
| XSS in Draft Orders in Timeline i SHOPIFY Admin Site!#117449 | Valid | Cross-site Scripting | – | 2016-07-28 | – | 7 |
| Stored passive XSS at scheduled posts (kitcrm.com)#214581 | Valid | Cross-site Scripting | Medium | 2017-03-28 | – | 7 |
| [h1-2102] Stored XSS in product description via `productUpdate` GraphQL query leads to XSS at handshake-web-internal.shopifycloud.com/products/[ID]#1085546 | Valid | Cross-site Scripting | Medium | 2022-07-11 | $1,600 | 9 |
| Reflected XSS in cart at hardware.shopify.com#95089 | Valid | Cross-site Scripting | – | 2015-12-22 | $500 | 10 |
| XSS stored in the Shopify Email app#1033882 | Valid | Cross-site Scripting | Low | 2020-11-19 | – | 10 |
| shopifyapps.com XSS on sales channels via currency formatting#104359 | Valid | Cross-site Scripting | – | 2015-12-14 | $1,000 | 12 |
| Unsanitized Location Name in POS Channel can lead to XSS in Orders Timeline#166887 | Valid | Cross-site Scripting | – | 2016-09-19 | – | 12 |
| XSS in SHOPIFY: Unsanitized Supplier Name can lead to XSS in Transfers Timeline#167075 | Valid | Cross-site Scripting | – | 2016-09-19 | – | 12 |
| Stored XSS at 'Buy Button' page#186462 | Valid | Cross-site Scripting | – | 2016-12-16 | $500 | 13 |
| Subdomain takeover on s3.shopify.com#207576 | Valid | Cross-site Scripting | – | 2017-02-27 | $500 | 13 |
| Stored XSS in *.myshopify.com#241008 | Valid | Cross-site Scripting | Medium | 2017-06-27 | – | 13 |
| Reflective XSS on wholesale.shopify.com#106293 | Valid | Cross-site Scripting | – | 2015-12-21 | $500 | 14 |
| Unauthenticated Stored XSS on <any>.myshopify.com via checkout page#189378 | Valid | Cross-site Scripting | – | 2016-12-16 | – | 14 |
| Stored XSS in partners dashboard#271765 | Valid | Cross-site Scripting | Low | 2018-04-18 | – | 14 |
| XSS on postal codes#192140 | Valid | Cross-site Scripting | Medium | 2017-01-11 | – | 15 |
| stored xss in invited team member via email parameter#267177 | Valid | Cross-site Scripting | Medium | 2017-11-03 | $500 | 16 |
| Cross Site Scripting at https://app.oberlo.com/#542258 | Valid | Cross-site Scripting | Medium | 2019-05-26 | – | 16 |
| DOM XSS via Shopify.API.remoteRedirect#576532 | Valid | Cross-site Scripting | Low | 2019-06-05 | – | 16 |
| Self XSS in Timeline#854299 | Valid | Cross-site Scripting | – | 2020-08-25 | – | 16 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.