Ability to publish a paid theme without purchasing it. Analysed #953083 Valid Access Control Low 2020-08-27 $2,000 90 Bypass of biometrics security functionality is possible in Android application (com.shopify.mobile) Analysed #637194 Valid Authentication Low 2019-08-14 $500 90 Reverse Proxy misroute leading to steal X-Shopify-Access-Token header Analysed #429617 Valid Server-Side Request Forgery Medium 2019-03-14 $1,000 90 Add new development stores without permission Analysed #1167453 Valid Access Control Medium 2021-06-04 – 89 URL Path Manipulation Enables Cache Poisoning of Amazon Affiliate Products in Shopify Linkpop Analysed #1848940 Valid Other weaknesses Low 2025-08-14 $500 88 XSS on $shop$.myshopify.com/admin/ and partners.shopify.com via whitelist bypass in SVG icon for sales channel applications Analysed #232174 Valid Cross-site Scripting High 2017-06-27 $5,000 88 No Session Expiry after log-out, attacker can reuse the old cookies Analysed #1162443 Valid Authentication Low 2024-05-01 $500 87 Ability to link a Google account to another staff account/store owner that isn't linked yet Analysed #892904 Valid No weakness recorded – 2020-07-14 – 84 https://themes.shopify.com::: Host header web cache poisoning lead to DoS Analysed #1096609 Valid Denial of Service Medium 2021-04-08 $2,900 82 SVG Server Side Request Forgery (SSRF) Analysed #223203 Valid Server-Side Request Forgery Low 2017-09-22 $500 81 Reflective Cross-site Scripting via Newsletter Form Analysed #709336 Valid Cross-site Scripting High 2019-10-11 $2,000 79 admin.shopify.com: Shopify Flow continues sending internal emails to a configured recipient after the staff author is removed #3628961 Informative No weakness recorded None 2026-07-03 – 78 Exposure of shopify employee summit page allows anonymous user to place orders for free books #2552027 Informative Input Validation and Logic None 2024-07-29 – 76 Blog posts atom feed of a store with password protection can be accessed by anyone Analysed #1256375 Valid Information Disclosure Medium 2021-11-08 – 76 Stored XSS in /admin/product and /admin/collections Analysed #1147433 Valid Cross-site Scripting Medium 2022-12-01 $5,300 76 ██████ DOM XSS via Shopify.API.remoteRedirect Analysed #646505 Valid Cross-site Scripting Low 2019-09-15 – 76 Ability to verify any email address you don't own - accounts.shopify.com Analysed #229619 Valid Misconfiguration and Insecure Design – 2019-11-08 – 76 xss stored Analysed #798599 Valid Cross-site Scripting – 2020-04-03 – 75 Stored XSS in Discounts section Analysed #618031 Valid Cross-site Scripting Medium 2019-06-27 $1,000 75 Blind Stored XSS in shopify internal Parquet Viewer Analysed #1103298 Valid Cross-site Scripting Medium 2024-02-08 – 74 CircleCI token in github repo allows for access to sensitive build information Analysed #858915 Valid Information Disclosure – 2020-09-15 – 74 A staff member with no permissions can edit Store Customer Email Analysed #980511 Valid Insecure Direct Object Reference Medium 2020-10-22 $1,500 72 help.shopify.com Cross Site Scripting Analysed #564196 Valid Cross-site Scripting Low 2019-05-12 – 71 myshopify.com domain takeover Analysed #320355 Valid Input Validation and Logic Medium 2018-02-27 – 71 Stealing livechat token and using it to chat as the user - user information disclosure Analysed #151058 Valid Authentication – 2016-07-19 – 71 xss is triggered on your web Analysed #1121900 Valid Cross-site Scripting Medium 2021-12-06 – 69 POST-based XSS on apps.shopify.com Analysed #429679 Valid Cross-site Scripting Low 2019-03-14 $500 69 Session works after logout from Shopify account Analysed #340191 Valid Race Conditions Low 2020-03-30 – 69 Reflected XSS in <any>.myshopify.com through theme preview Analysed #226428 Valid Cross-site Scripting – 2017-05-29 – 69 Subdomain Takeover Via unclaimed Heroku Instance tim-exclusive.shopify.com Analysed #424669 Valid Authentication – 2021-02-24 $500 68 Stored XSS through Facebook Page Connection Analysed #267570 Valid Cross-site Scripting Low 2020-04-04 – 68 A non-privileged user may create an admin account in Stocky Analysed #1245736 Valid Access Control Medium 2021-11-25 – 67 Cache poisoning via X-Forwarded-Host in www.shopify.com/partners/blog Analysed #977851 Valid Injection and Smuggling Low 2020-09-11 $1,000 67 Staff without Manage Themes permissions can update themes Analysed #1550400 Valid No weakness recorded Medium 2024-01-23 – 66 Shopify GitHub Login and Password exposed all private source code might be available. Analysed #124100 Valid Information Disclosure – 2017-06-08 $1,500 66 URL Scheme Validation Bypass in Shopify Mobile App Allows Javascript Execution Analysed #1737358 Valid Access Control Low 2025-09-17 – 65 Ability to Disable the Login Attempt of any Shopify Owner for 24 hrs (Zero_Click) Analysed #1406495 Valid Input Validation and Logic Low 2022-02-15 $900 65 Disclose customer orders details by shopify chat application. Analysed #968165 Valid Information Disclosure Medium 2022-05-14 $2,500 65 Session Persistence Designed to Keep Users Logged In Across Multiple Devices (Intended Behaviour) #3161827 Informative Authentication None 2025-09-04 – 63 Xss triggered in Your-store.myshopify.com/admin/apps/shopify-email/editor/**** Analysed #1472471 Valid Cross-site Scripting Medium 2022-04-25 $2,900 63 Insufficient session expiration in the **com.shopify.ping** android app Analysed #1172205 Valid Authentication Low 2021-11-26 – 63 Using GraphQL, STAFF with NO explicit permissions on Store can retrieve Shopify Payments Balance. Analysed #417170 Valid Information Disclosure Low 2019-04-04 $500 62 Unauthenticated access to Zendesk tickets through athena-flex-production.shopifycloud.com Okta bypass Analysed #397130 Valid Authentication Critical 2018-09-19 – 61 Open redirect using theme install Analysed #101962 Valid Open Redirect – 2015-12-14 – 61 Non-store owners can transfer Shopify-managed domain to another domain provider Analysed #1820953 Valid Access Control Medium 2024-01-17 – 58 Removing parts of URL from jQuery request exposes links for download of Paid Digital Assets of the most recent Order placed by anyone on the store! Analysed #1044285 Valid No weakness recorded Medium 2021-07-08 $2,900 58 XSS Stored via Upload avatar PNG [HTML] File in accounts.shopify.com Analysed #964550 Valid Misconfiguration and Insecure Design Low 2020-08-30 – 58 Reflected XSS on $Any$.myshopify.com/admin Analysed #422707 Valid Cross-site Scripting High 2018-11-13 $1,500 58 H1514 [beerify.shopifycloud.com] GraphQL discloses internal beer consumption Analysed #419883 Valid Information Disclosure None 2019-05-08 $802 57 staff can able to extend shopify trial period without admin permission Analysed #947728 Valid Access Control Low 2020-09-15 – 56