Account takeover intercepting magic link for Arrive app Analysed #855618 Valid Authentication Low 2020-07-15 – 33 Script Editor preview token still working with uninstalled application, even for unpublished script Analysed #915940 Valid No weakness recorded – 2020-08-25 – 33 Xss At Shopify Email App Analysed #1339356 Valid Cross-site Scripting Low 2021-12-24 – 33 Unauthenticated access to Checkout Blocks employee-only endpoints exposed merchant metadata #3954327 Valid Authentication Medium 2026-11-03 $3,100 33 Bypass Filter and get Stored Xss Analysed #299424 Valid Cross-site Scripting High 2018-12-12 $3,000 34 DOM XSS via Shopify.API.Modal.initialize Analysed #602767 Valid Cross-site Scripting Low 2019-06-21 $500 34 [h1-2102] Improper Access Control at https://shopify.plus/[id]/users/api in operation UpdateOrganizationUserTfaEnforcement Analysed #1085042 Valid Access Control Medium 2022-07-11 – 34 [h1-2102] Wholesale - CSRF to Generate Invitation Token for a Customer and Move Customer to Invited Status Analysed #1091209 Valid Cross-Site Request Forgery Low 2021-12-06 – 34 Production Key and Data Found on Subdomain No Longer Operated by Shopify / Dangling DNS Analysed #1590115 Valid Information Disclosure None 2024-05-01 – 34 Stored XSS in Dovetale by application of creator Analysed #1652046 Valid Cross-site Scripting Medium 2022-11-29 $1,600 34 Stored XSS Deleting Menu Links in the Shopify Admin Analysed #263876 Valid Cross-site Scripting Medium 2017-09-08 – 35 Self-XSS in password reset functionality Analysed #286667 Valid Cross-site Scripting Low 2017-11-10 – 35 XSS *.myshopify.com/collections/vendors?q= Analysed #324136 Valid Cross-site Scripting Medium 2018-04-08 – 35 XSS on product comments in transfers Analysed #738072 Valid Cross-site Scripting Low 2019-12-09 $500 35 Timeline Editor Self-XSS (Previous Fix #738072 Incomplete) Analysed #755679 Valid Cross-site Scripting Low 2020-03-16 $500 35 [h1-2102] shopApps query from the graphql at /users/api returns all existing created apps, including private ones Analysed #1085332 Valid Information Disclosure Medium 2022-07-15 $1,900 35 Unathorised access to admin endpoint on plus-website-staging5.shopifycloud.com Analysed #1394982 Valid Access Control Medium 2021-12-03 – 35 mruby-engine: UAF in MRubyEngine#initialize enables local RCE #3679660 Informative No weakness recorded None 2026-04-24 – 35 Stored XSS in [shop].myshopify.com/admin/orders/[id] Analysed #214044 Valid Cross-site Scripting – 2017-03-28 – 36 Race condition at create new Location Analysed #413759 Valid Input Validation and Logic Low 2018-10-05 $500 36 One Click XSS in [www.shopify.com] Analysed #1563334 Valid Cross-site Scripting – 2022-07-13 – 36 (BYPASS) Open redirect and XSS in supporthiring.shopify.com Analysed #158434 Valid Cross-Site Request Forgery – 2016-11-21 – 37 Tinymce 2.4.0 Analysed #262230 Valid Cross-site Scripting Medium 2017-09-26 $2,000 37 Stored XSS on demo app link Analysed #439912 Valid Cross-site Scripting Medium 2020-06-12 – 37 Low Privileged user can add or remove cash to/from sales register Analysed #905543 Valid Access Control Low 2021-06-16 – 37 Removed staff members who had "Manage shops" permission can still create development stores Analysed #254588 Valid Access Control Medium 2019-11-08 – 38 Replace other user files in Inbox messages Analysed #322661 Valid Insecure Direct Object Reference Medium 2018-05-01 – 38 StoreFront API allows for a brute force attack on customer login by not timing out ALL attempts Analysed #708013 Valid Authentication Medium 2019-10-07 – 38 Low privileged user can create high privileged user's KITCRM authorization token and can read and write message to KIT Analysed #909863 Valid Insecure Direct Object Reference Medium 2021-02-07 – 38 Potential to abuse pricing errors in saved carts Analysed #336131 Valid Input Validation and Logic Medium 2018-05-02 – 39 App messaging can be hijacked by third-party websites Analysed #387279 Valid Misconfiguration and Insecure Design Medium 2018-11-07 – 39 Stored XSS on buy button Analysed #397088 Valid Cross-site Scripting Low 2018-09-29 $500 39 Inject page in admin panel via Shopify.API.pushState with protocol invalid Analysed #868615 Valid Cross-site Scripting Low 2020-12-27 $500 39 Misconfiguration in Two Factor Authorisation Analysed #178293 Valid No weakness recorded – 2016-12-17 $1,500 40 User sensitive information disclosure Analysed #975047 Valid Information Disclosure Medium 2020-10-22 $1,000 40 Disclosure of Github Issues Analysed #425719 Valid Information Disclosure Medium 2018-11-08 – 41 Exposed Slinky Instance Admin Panel Analysed #808762 Valid Authentication None 2021-01-16 – 41 Authentication Bypass on Icinga monitoring server Analysed #143482 Valid Authentication – 2016-07-17 – 42 XSS on services.shopify.com Analysed #591786 Valid Cross-site Scripting Low 2019-06-14 $500 43 H1514 Removed Staff members who had "Apps" permission can still modify flow app connections Analysed #416983 Valid Access Control Low 2019-06-14 – 44 Subdomain Takeover - https://competition.shopify.com/ Analysed #365853 Valid Access Control Medium 2018-06-19 – 45 Blind Stored XSS Via Staff Name Analysed #948929 Valid Cross-site Scripting High 2020-08-18 $3,000 45 H1514 DOM XSS on checkout.shopify.com via postMessage handler on /:id/sandbox/google_maps Analysed #423218 Valid Cross-site Scripting Medium 2019-11-04 $500 46 xss stored in https://your store.myshopify.com/admin/ Analysed #887879 Valid Cross-site Scripting Low 2020-08-24 $1,000 46 [h1-2102] [Yaworski's Broskis] Low privilege user can read POS PINs via graphql and elevate his privilege Analysed #1091303 Valid Information Disclosure Medium 2021-04-08 – 46 Collaborators and Staff members without all necessary permissions are able to create, edit and install custom apps Analysed #1555502 Valid Access Control Medium 2022-07-11 $1,900 46 Able to Login deactivated staff account in shopify app mobile Analysed #175490 Valid Access Control – 2016-11-29 – 48 Stored XSS in blog comments through Shopify API Analysed #192210 Valid Cross-site Scripting Medium 2017-03-16 – 48 apps.shopify.com - CSRF token leakage through Google Analytics Analysed #196458 Valid Cross-Site Request Forgery – 2017-02-07 – 48 H1514 Bypass Wholesale account signup restrictions Analysed #423496 Valid Access Control Medium 2019-06-07 – 48