many xss in widgets.shopifyapps.com #105659 Valid Cross-site Scripting – 2016-02-04 $500 1 www.shopify.com XSS via third-party script #111475 Valid Cross-site Scripting – 2016-02-01 $500 1 XSS on hardware.shopify.com #116006 Valid Cross-site Scripting – 2016-03-01 $500 1 xss in the all widgets of shopifyapps.com #119250 Valid Cross-site Scripting – 2016-03-16 $500 1 Stored XSS via "Free Shipping" option (Discounts) #124429 Valid Cross-site Scripting – 2016-04-05 $500 1 XSS on ecommerce.shopify.com #56779 Valid Cross-site Scripting – 2015-09-06 – 2 Bulk Discount App in myshopify.com exposes http://bulkdiscounts.shopifyapps.com vulnerable to XSS #62861 Valid Cross-site Scripting – 2015-07-23 – 2 XSS in Myshopify Admin Site in DISCOUNTS #71614 Valid Cross-site Scripting – 2015-07-20 – 2 XSS at Bulk editing ProductVariants #72331 Valid Cross-site Scripting – 2015-06-25 $500 2 Body injection in mailto link while commenting shop blog #72976 Valid No weakness recorded – 2015-09-10 – 2 Reflected XSS in chat #73566 Valid Cross-site Scripting – 2015-08-11 – 2 XSS https://www.shopify.com/signup #85291 Valid Cross-site Scripting – 2015-08-31 $500 2 www.shopify.com XSS on blog pages via sharing buttons #87168 Valid Cross-site Scripting – 2015-10-21 $500 2 unauthorized access to all collections name #93004 Valid Access Control – 2015-10-14 $2,000 2 Cookie securing your "Opening soon" store is not secured against XSS #100956 Valid Misconfiguration and Insecure Design – 2015-12-01 – 2 CSRF in Connecting Pinterest Account #104931 Valid Cross-Site Request Forgery – 2016-02-02 – 2 Stored XSS in /admin/orders #106897 Valid Cross-site Scripting – 2016-02-17 – 2 Injection via CSV Export feature in Admin Orders #118103 Valid No weakness recorded – 2016-03-12 – 2 Stored XSS in https://checkout.shopify.com/ #122849 Valid Cross-site Scripting – 2016-03-15 $500 2 XSS on https://app.shopify.com/ #126539 Valid Cross-site Scripting – 2016-04-05 $500 2 staff memeber can install apps even if have limitied access #134757 Valid Access Control – 2016-05-04 – 2 Redirect url after login is not validated #153652 Valid Open Redirect – 2016-07-28 – 2 Setting Arbitrary Cookie at kitcrm.com #213991 Valid No weakness recorded – 2017-08-23 – 2 OrderListInitial leaks order details #882412 Valid Information Disclosure – 2020-08-18 $1,500 2 Invitation issue #56726 Valid Access Control – 2015-09-16 – 3 XSS on support.shopify.com #56760 Valid Cross-site Scripting – 2015-06-09 – 3 XSS at importing Product List #67125 Valid Cross-site Scripting – 2015-06-17 $500 3 XSS at Bulk editing products #67132 Valid Cross-site Scripting – 2015-06-17 $500 3 Expire User Sessions in Admin Site does not expire user session in Shopify Application in IOS #67220 Valid Authentication – 2015-07-15 – 3 XSS https://delivery.shopifyapps.com/ (Digital Downloads App in myshopify.com) #81441 Valid Cross-site Scripting – 2015-08-24 – 3 Privilege escalation vulnerability #90671 Valid Denial of Service – 2015-10-14 – 3 Passwords Returned in Later Responses. #90862 Valid Misconfiguration and Insecure Design – 2015-09-30 – 3 Accessing Payments page and adding payment methods with limited access accounts #92481 Valid Access Control – 2015-11-10 $500 3 First & Last Name Disclosure of any Shopify Store Admin #93294 Valid Access Control – 2015-11-09 – 3 Unauthenticated access to details of hidden products in any shop via title emuneration #93394 Valid Authentication – 2015-10-23 $1,000 3 Bypassing password requirement during deletion of accout #93901 Valid Authentication – 2015-11-03 – 3 Arbitrary read on s3://shopify-delivery-app-storage/files #94087 Valid Authentication – 2015-10-20 $1,500 3 A 'Full access' administrator is able to see the shop owners user details #96890 Valid Access Control – 2015-11-10 $500 3 List of devices is accessible regardless of the account limitations #97535 Valid Information Disclosure – 2015-11-10 $500 3 Apps can access 'channels' beta api #98499 Valid Access Control – 2015-11-18 $500 3 XSS in creating tweets #101450 Valid Cross-site Scripting – 2015-12-03 – 3 CSRF on https://shopify.com/plus #114430 Valid Information Disclosure – 2016-02-17 $500 3 Get analytics token using only apps permission #901775 Valid Information Disclosure – 2020-08-18 – 3 [persistent cross-site scripting] customers can target admins #55842 Valid Cross-site Scripting – 2015-07-01 – 4 CSRF token fixation in facebook store app that can lead to adding attacker to victim acc #55911 Valid Misconfiguration and Insecure Design – 2015-06-25 $500 4 Notification request disclose private information about other myshopify accounts #56936 Valid Authentication – 2015-09-24 – 4 XSS in myshopify.com Admin site in TAX Overrides #62427 Valid Cross-site Scripting – 2015-06-09 – 4 Header Misconfiguration - PHP API #64941 Valid Misconfiguration and Insecure Design – 2015-06-11 – 4 Bypass access restrictions from API #67557 Valid Authentication – 2015-09-18 $1,000 4 Prevent Shop Admin From Seeing his Installed Apps / Install Persistent Unremovable App #72793 Valid Denial of Service – 2015-09-29 – 4