Github access token exposure Analysed #1087489 Valid No weakness recorded Critical 2021-07-26 $50,000 1,601 DoS Vulnerability via Cache Poisoning on cdn.shopify.com and shopify-assets.shopifycdn.com Analysed #1695604 Valid Other weaknesses Medium 2025-06-04 $3,800 266 XSS at jamfpro.shopifycloud.com Analysed #1444682 Valid Cross-site Scripting Medium 2023-02-02 $9,400 240 H1514 [*.(my)shopify.com] - Viewing Password Protected Content Analysed #421859 Valid Authentication Critical 2019-05-22 $3,000 192 XSS at https://exchangemarketplace.com/blogsearch Analysed #1145162 Valid Cross-site Scripting Medium 2021-04-09 – 174 XSS in www.shopify.com/markets?utm_source= Analysed #1699762 Valid Cross-site Scripting Low 2022-10-18 – 159 Informations disclosure - Access to some checkout informations Analysed #1064869 Valid No weakness recorded Medium 2021-03-13 – 150 H1514 Session Fixation on multiple shopify-built apps on *.shopifycloud.com and *.shopifyapps.com Analysed #423136 Valid Authentication – 2019-04-25 – 144 Reflected XSS In Marketing Reports Page On *.myshopify.com/admin Analysed #1754843 Valid Cross-site Scripting Medium 2025-04-15 – 128 XSS on any Shopify shop via abuse of the HTML5 structured clone algorithm in postMessage listener on "/:id/digital_wallets/dialog" Analysed #231053 Valid Cross-site Scripting – 2017-05-30 $3,000 121 Account Takeover Vulnerability in Shopify Collabs Platform Due to Missing Email Verification Analysed #1679734 Valid No weakness recorded Low 2025-03-11 $800 112 Reflected XSS on help.shopify.com Analysed #1940245 Valid Cross-site Scripting Low 2024-01-25 $500 111 Access to Employee calendar disclosing internal presentation and meetings Analysed #489284 Valid Access Control Low 2019-03-08 $1,000 111 Reflected XSS in AI Chat Bot Greetings at help.shopify.com via Markdown Image Rendering Analysed #2509022 Valid Cross-site Scripting Medium 2026-06-18 $1,600 110 Admin panel Exposure without credential at https://plus-website.shopifycloud.com/admin.php Analysed #1417288 Valid Access Control Medium 2022-08-11 $2,900 109 Reflected XSS in *.myshopify.com/account/register Analysed #470206 Valid Cross-site Scripting Medium 2019-03-12 – 104 Exposed Cortex API at https://cortex-ingest.shopifycloud.com/ Analysed #1258871 Valid Misconfiguration and Insecure Design Medium 2022-12-02 $6,300 101 Reflected XSS online-store-git.shopifycloud.com Analysed #1410459 Valid Cross-site Scripting Medium 2022-01-20 $3,500 98 https://themes.shopify.com::: Host header web cache poisoning lead to DoS Analysed #1096609 Valid Denial of Service Medium 2021-04-08 $2,900 82 Reflective Cross-site Scripting via Newsletter Form Analysed #709336 Valid Cross-site Scripting High 2019-10-11 $2,000 79 Blog posts atom feed of a store with password protection can be accessed by anyone Analysed #1256375 Valid Information Disclosure Medium 2021-11-08 – 76 CircleCI token in github repo allows for access to sensitive build information Analysed #858915 Valid Information Disclosure – 2020-09-15 – 74 help.shopify.com Cross Site Scripting Analysed #564196 Valid Cross-site Scripting Low 2019-05-12 – 71 Stealing livechat token and using it to chat as the user - user information disclosure Analysed #151058 Valid Authentication – 2016-07-19 – 71 Reflected XSS in <any>.myshopify.com through theme preview Analysed #226428 Valid Cross-site Scripting – 2017-05-29 – 69 Subdomain Takeover Via unclaimed Heroku Instance tim-exclusive.shopify.com Analysed #424669 Valid Authentication – 2021-02-24 $500 68 Cache poisoning via X-Forwarded-Host in www.shopify.com/partners/blog Analysed #977851 Valid Injection and Smuggling Low 2020-09-11 $1,000 67 Shopify GitHub Login and Password exposed all private source code might be available. Analysed #124100 Valid Information Disclosure – 2017-06-08 $1,500 66 Disclose customer orders details by shopify chat application. Analysed #968165 Valid Information Disclosure Medium 2022-05-14 $2,500 65 Unauthenticated access to Zendesk tickets through athena-flex-production.shopifycloud.com Okta bypass Analysed #397130 Valid Authentication Critical 2018-09-19 – 61 Open redirect using theme install Analysed #101962 Valid Open Redirect – 2015-12-14 – 61 Removing parts of URL from jQuery request exposes links for download of Paid Digital Assets of the most recent Order placed by anyone on the store! Analysed #1044285 Valid No weakness recorded Medium 2021-07-08 $2,900 58 H1514 [beerify.shopifycloud.com] GraphQL discloses internal beer consumption Analysed #419883 Valid Information Disclosure None 2019-05-08 $802 57 EC2 Takeover at turn.shopify.com Analysed #1295497 Valid Cross-site Scripting Low 2022-03-28 – 52 Shopify.com Web Cache Deception vulnerability leads to personal information and CSRF tokens leakage Analysed #1271944 Valid Misconfiguration and Insecure Design Low 2021-10-21 $800 48 Reflected XSS Analysed #569241 Valid Cross-site Scripting Low 2019-05-28 – 48 Subdomain Takeover - https://competition.shopify.com/ Analysed #365853 Valid Access Control Medium 2018-06-19 – 45 Authentication Bypass on Icinga monitoring server Analysed #143482 Valid Authentication – 2016-07-17 – 42 Disclosure of Github Issues Analysed #425719 Valid Information Disclosure Medium 2018-11-08 – 41 App messaging can be hijacked by third-party websites Analysed #387279 Valid Misconfiguration and Insecure Design Medium 2018-11-07 – 39 StoreFront API allows for a brute force attack on customer login by not timing out ALL attempts Analysed #708013 Valid Authentication Medium 2019-10-07 – 38 (BYPASS) Open redirect and XSS in supporthiring.shopify.com Analysed #158434 Valid Cross-Site Request Forgery – 2016-11-21 – 37 One Click XSS in [www.shopify.com] Analysed #1563334 Valid Cross-site Scripting – 2022-07-13 – 36 Stored XSS in [shop].myshopify.com/admin/orders/[id] Analysed #214044 Valid Cross-site Scripting – 2017-03-28 – 36 XSS *.myshopify.com/collections/vendors?q= Analysed #324136 Valid Cross-site Scripting Medium 2018-04-08 – 35 Self-XSS in password reset functionality Analysed #286667 Valid Cross-site Scripting Low 2017-11-10 – 35 Stored XSS in Dovetale by application of creator Analysed #1652046 Valid Cross-site Scripting Medium 2022-11-29 $1,600 34 Production Key and Data Found on Subdomain No Longer Operated by Shopify / Dangling DNS Analysed #1590115 Valid Information Disclosure None 2024-05-01 – 34 DOM XSS via Shopify.API.Modal.initialize Analysed #602767 Valid Cross-site Scripting Low 2019-06-21 $500 34 XSS on "widgets.shopifyapps.com" via "stripping" attribute and "shop" parameter Analysed #246794 Valid Cross-site Scripting None 2018-04-03 $1,000 32