Unathorised access to admin endpoint on plus-website-staging5.shopifycloud.com Analysed #1394982 Valid Access Control Medium 2021-12-03 – 35 [h1-2102] shopApps query from the graphql at /users/api returns all existing created apps, including private ones Analysed #1085332 Valid Information Disclosure Medium 2022-07-15 $1,900 35 Timeline Editor Self-XSS (Previous Fix #738072 Incomplete) Analysed #755679 Valid Cross-site Scripting Low 2020-03-16 $500 35 XSS on product comments in transfers Analysed #738072 Valid Cross-site Scripting Low 2019-12-09 $500 35 XSS *.myshopify.com/collections/vendors?q= Analysed #324136 Valid Cross-site Scripting Medium 2018-04-08 – 35 Self-XSS in password reset functionality Analysed #286667 Valid Cross-site Scripting Low 2017-11-10 – 35 Stored XSS Deleting Menu Links in the Shopify Admin Analysed #263876 Valid Cross-site Scripting Medium 2017-09-08 – 35 Stored XSS in Dovetale by application of creator Analysed #1652046 Valid Cross-site Scripting Medium 2022-11-29 $1,600 34 Production Key and Data Found on Subdomain No Longer Operated by Shopify / Dangling DNS Analysed #1590115 Valid Information Disclosure None 2024-05-01 – 34 [h1-2102] Wholesale - CSRF to Generate Invitation Token for a Customer and Move Customer to Invited Status Analysed #1091209 Valid Cross-Site Request Forgery Low 2021-12-06 – 34 [h1-2102] Improper Access Control at https://shopify.plus/[id]/users/api in operation UpdateOrganizationUserTfaEnforcement Analysed #1085042 Valid Access Control Medium 2022-07-11 – 34 DOM XSS via Shopify.API.Modal.initialize Analysed #602767 Valid Cross-site Scripting Low 2019-06-21 $500 34 Bypass Filter and get Stored Xss Analysed #299424 Valid Cross-site Scripting High 2018-12-12 $3,000 34 Unauthenticated access to Checkout Blocks employee-only endpoints exposed merchant metadata #3954327 Valid Authentication Medium 2026-11-03 $3,100 33 Xss At Shopify Email App Analysed #1339356 Valid Cross-site Scripting Low 2021-12-24 – 33 Script Editor preview token still working with uninstalled application, even for unpublished script Analysed #915940 Valid No weakness recorded – 2020-08-25 – 33 Account takeover intercepting magic link for Arrive app Analysed #855618 Valid Authentication Low 2020-07-15 – 33 [Privilege Escalation] Shopify Admin -- Permission from Settings to Customer Analysed #541606 Valid No weakness recorded Low 2019-07-05 – 33 Cross-site scripting in "Contact customer" form Analysed #294505 Valid Cross-site Scripting Low 2017-12-19 – 33 IDOR [partners.shopify.com] - User with ONLY Manage apps permission is able to get shops info and staff names from inside the shop Analysed #243943 Valid Insecure Direct Object Reference Medium 2017-07-19 $500 33 Add new managed stores without permission Analysed #1167753 Valid Access Control Medium 2021-07-08 – 32 Ability to see password protected content by bypassing the password page of shopify preview URL for new development stores (as of August 17, 2020) Analysed #961929 Valid Information Disclosure Medium 2020-08-25 $1,500 32 XSS on "widgets.shopifyapps.com" via "stripping" attribute and "shop" parameter Analysed #246794 Valid Cross-site Scripting None 2018-04-03 $1,000 32 Shop App - Attacker is able to intercept authorization code during authentication (OAuth) and is able to get access to Microsoft Outlook email account Analysed #1700734 Valid Authentication Low 2023-03-02 $900 31 [h1-2102] Improper Access Control at https://shopify.plus/[id]/users/api in operation UpdateOrganizationUserRole Analysed #1084638 Valid Access Control Medium 2022-04-21 – 31 XSS in $shop$.myshopify.com/admin/ via twine template injection in "Shopify.API.Modal.input" method when using a malicious app Analysed #217790 Valid Cross-site Scripting High 2017-06-01 $1,000 31 Fetching external resources through svg images Analysed #142709 Valid Information Disclosure – 2016-06-21 – 31 any staff members have the ability to comment in [discounts] he/she can disable comment section it to other staff even the admin of the store Analysed #629150 Valid Access Control Low 2019-07-15 – 30 H1514 Deanonymizing Exchange Marketplace private listings Analysed #421009 Valid Information Disclosure Medium 2020-03-10 $1,000 30 XSS in $shop$.myshopify.com/admin/ via "Button Objects" in malicious app Analysed #217745 Valid Cross-site Scripting High 2017-05-22 $800 30 CSRF in all API endpoints when authenticated using HTTP Authentication Analysed #195156 Valid Cross-Site Request Forgery – 2017-03-28 – 30 Stored XSS in https://productreviews.shopifyapps.com/proxy/v4/reviews/product Analysed #168458 Valid Cross-site Scripting – 2019-11-08 – 30 Open Redirect at *.myshopify.com/account/login?checkout_url= Analysed #103772 Valid Open Redirect – 2015-12-16 – 30 Senseitive data Related to Shopify Host -> https://shopify.zendesk.com/ Analysed #1298809 Valid Cryptography None 2021-11-08 – 29 Self xss in product reviews Analysed #1029668 Valid Cross-site Scripting Medium 2020-11-19 – 29 Ability to connect an external login service for unverified emails/accounts at accounts.shopify.com Analysed #1018489 Valid Authentication Medium 2022-04-13 $1,600 29 Path Traversal in App Proxy Analysed #869888 Valid File and Path Handling Medium 2020-08-24 – 29 Potentially Sensitive Information on GitHub Analysed #143438 Valid Information Disclosure – 2016-07-17 – 29 IDOR expire other user sessions Analysed #56511 Valid Authentication – 2015-04-17 $1,000 29 GraphQL Introspection Enabled on Shopify API Endpoint (Intended Behavior) #2886723 Informative Information Disclosure None 2025-09-17 – 28 Bypass report #416983 - Removed Staff members who had "Apps" permission can still modify flow app connections Analysed #698708 Valid Access Control Medium 2019-10-10 – 28 Open redirect in bulk edit Analysed #169759 Valid Open Redirect – 2016-12-04 – 28 Attention! Remote Code Execution at http://wpt.ec2.shopify.com/ Analysed #73567 Valid Command and Code Injection – 2015-07-16 – 28 XSS seems to work again after change to linkpop at https://linkpop.com/testnaglinagli Analysed #1569940 Valid Cross-site Scripting Medium 2022-10-13 – 27 Stored - XSS Analysed #532643 Valid Cross-site Scripting Medium 2019-05-28 – 27 subdomain Takeover at blog.exchangemarketplace.com Analysed #416474 Valid No weakness recorded Low 2018-10-01 – 27 Staff can create workflows in Shopify Admin without apps permission Analysed #1521336 Valid Access Control Medium 2022-10-13 – 26 Direct Access To admin Dashboard Analysed #1421804 Valid Authentication None 2022-01-20 – 26 Sidekiq dashboard exposed at notary.shopifycloud.com Analysed #1405673 Valid Information Disclosure Medium 2021-11-25 – 26 Staff can use BULK_OPERATIONS_FINISH webhook topic using Graphql without permissions all Analysed #1350095 Valid Access Control Medium 2021-12-04 – 26