Skip to content
Connect AISign inSign up free

Bug bounty reports15,219

Atlas

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Program:Shopify
Status
Severity
Weakness:Cross-site Scripting
Clear
Year
Bounty paid62
Access stated
Access needed
Technique
Clear filters127 of 15,219 reports
Disclosed bug bounty reports
ReportStatusWeaknessSeverityDisclosedBountyVotes
XSS while logging using GoogleAnalysed#691611ValidCross-site Scripting–2019-09-11$1,750341
Stored XSS in my staff name fired in another your internal panelAnalysed#946053ValidCross-site ScriptingHigh2020-07-29–326
XSS at jamfpro.shopifycloud.comAnalysed#1444682ValidCross-site ScriptingMedium2023-02-02$9,400240
H1514 DOMXSS on Embedded SDK via Shopify.API.setWindowLocation abusing cookie StuffingAnalysed#422043ValidCross-site ScriptingHigh2019-04-17–195
XSS at https://exchangemarketplace.com/blogsearchAnalysed#1145162ValidCross-site ScriptingMedium2021-04-09–174
XSS in www.shopify.com/markets?utm_source=Analysed#1699762ValidCross-site ScriptingLow2022-10-18–159
Stored XSS in SVG file as data: urlAnalysed#1276742ValidCross-site ScriptingMedium2023-01-31$5,300153
Reflected XSS In Marketing Reports Page On *.myshopify.com/adminAnalysed#1754843ValidCross-site ScriptingMedium2025-04-15–128
Stored XSS in private message#729424ValidCross-site ScriptingMedium2019-11-08$1,000124
XSS on any Shopify shop via abuse of the HTML5 structured clone algorithm in postMessage listener on "/:id/digital_wallets/dialog"Analysed#231053ValidCross-site Scripting–2017-05-30$3,000121
Reflected XSS on help.shopify.comAnalysed#1940245ValidCross-site ScriptingLow2024-01-25$500111
Reflected XSS in AI Chat Bot Greetings at help.shopify.com via Markdown Image RenderingAnalysed#2509022ValidCross-site ScriptingMedium2026-06-18$1,600110
Stored XSS in Shopify ChatAnalysed#756729ValidCross-site ScriptingLow2019-12-23$500106
Reflected XSS in *.myshopify.com/account/registerAnalysed#470206ValidCross-site ScriptingMedium2019-03-12–104
Reflected XSS online-store-git.shopifycloud.comAnalysed#1410459ValidCross-site ScriptingMedium2022-01-20$3,50098
XSS on $shop$.myshopify.com/admin/ and partners.shopify.com via whitelist bypass in SVG icon for sales channel applicationsAnalysed#232174ValidCross-site ScriptingHigh2017-06-27$5,00088
Reflective Cross-site Scripting via Newsletter FormAnalysed#709336ValidCross-site ScriptingHigh2019-10-11$2,00079
Stored XSS in /admin/product and /admin/collectionsAnalysed#1147433ValidCross-site ScriptingMedium2022-12-01$5,30076
██████ DOM XSS via Shopify.API.remoteRedirectAnalysed#646505ValidCross-site ScriptingLow2019-09-15–76
xss storedAnalysed#798599ValidCross-site Scripting–2020-04-03–75
Stored XSS in Discounts sectionAnalysed#618031ValidCross-site ScriptingMedium2019-06-27$1,00075
Blind Stored XSS in shopify internal Parquet ViewerAnalysed#1103298ValidCross-site ScriptingMedium2024-02-08–74
help.shopify.com Cross Site ScriptingAnalysed#564196ValidCross-site ScriptingLow2019-05-12–71
xss is triggered on your webAnalysed#1121900ValidCross-site ScriptingMedium2021-12-06–69
POST-based XSS on apps.shopify.comAnalysed#429679ValidCross-site ScriptingLow2019-03-14$50069
Reflected XSS in <any>.myshopify.com through theme previewAnalysed#226428ValidCross-site Scripting–2017-05-29–69
Stored XSS through Facebook Page ConnectionAnalysed#267570ValidCross-site ScriptingLow2020-04-04–68
Xss triggered in Your-store.myshopify.com/admin/apps/shopify-email/editor/****Analysed#1472471ValidCross-site ScriptingMedium2022-04-25$2,90063
Reflected XSS on $Any$.myshopify.com/adminAnalysed#422707ValidCross-site ScriptingHigh2018-11-13$1,50058
Self XSSAnalysed#982510ValidCross-site Scripting–2020-09-17$50055
Stored XSS on activityAnalysed#391390ValidCross-site ScriptingHigh2018-08-14$2,00055
Stored XSS at https://linkpop.comAnalysed#1441988ValidCross-site ScriptingMedium2022-01-20–53
EC2 Takeover at turn.shopify.comAnalysed#1295497ValidCross-site ScriptingLow2022-03-28–52
Stored xssAnalysed#415484ValidCross-site ScriptingHigh2018-11-07$1,00052
Cross-site scripting on api.collabs.shopify.comAnalysed#1672459ValidCross-site ScriptingMedium2022-10-13$1,60051
Inject page in admin panel via Shopify.API.pushStateAnalysed#662083ValidCross-site ScriptingLow2019-09-09$50051
XSS within Shopify Email App - AdminAnalysed#869831ValidCross-site Scripting–2020-09-14–50
Reflected XSSAnalysed#569241ValidCross-site ScriptingLow2019-05-28–48
Stored XSS in blog comments through Shopify APIAnalysed#192210ValidCross-site ScriptingMedium2017-03-16–48
xss stored in https://your store.myshopify.com/admin/Analysed#887879ValidCross-site ScriptingLow2020-08-24$1,00046
H1514 DOM XSS on checkout.shopify.com via postMessage handler on /:id/sandbox/google_mapsAnalysed#423218ValidCross-site ScriptingMedium2019-11-04$50046
Blind Stored XSS Via Staff NameAnalysed#948929ValidCross-site ScriptingHigh2020-08-18$3,00045
XSS on services.shopify.comAnalysed#591786ValidCross-site ScriptingLow2019-06-14$50043
Inject page in admin panel via Shopify.API.pushState with protocol invalidAnalysed#868615ValidCross-site ScriptingLow2020-12-27$50039
Stored XSS on buy buttonAnalysed#397088ValidCross-site ScriptingLow2018-09-29$50039
Stored XSS on demo app linkAnalysed#439912ValidCross-site ScriptingMedium2020-06-12–37
Tinymce 2.4.0Analysed#262230ValidCross-site ScriptingMedium2017-09-26$2,00037
One Click XSS in [www.shopify.com]Analysed#1563334ValidCross-site Scripting–2022-07-13–36
Stored XSS in [shop].myshopify.com/admin/orders/[id]Analysed#214044ValidCross-site Scripting–2017-03-28–36
Timeline Editor Self-XSS (Previous Fix #738072 Incomplete)Analysed#755679ValidCross-site ScriptingLow2020-03-16$50035

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated