H1514 Remote Code Execution on kitcrm using bulk customer update of Priority Products Analysed #422944 Valid Command and Code Injection Medium 2020-02-06 – 830 SSRF in Exchange leads to ROOT access in all instances #341876 Valid Server-Side Request Forgery Medium 2018-05-23 – 587 Shopify Stocky App OAuth Misconfiguration Analysed #740989 Valid Access Control Medium 2019-12-11 – 527 H1514 Ability to MiTM Shopify PoS Session to Takeover Communications Analysed #423467 Valid Input Validation and Logic Medium 2019-11-04 – 372 Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email Confirmation Analysed #796956 Valid No weakness recorded Medium 2020-04-01 – 310 CSRF on connecting Paypal as Payment Provider Analysed #807924 Valid Cross-Site Request Forgery Medium 2020-04-10 – 304 DoS Vulnerability via Cache Poisoning on cdn.shopify.com and shopify-assets.shopifycdn.com Analysed #1695604 Valid Other weaknesses Medium 2025-06-04 $3,800 266 Shopify Partners Invitation Process Allows Privilege Escalation Without Email Verification Analysed #2885269 Valid Access Control Medium 2025-05-15 – 245 XSS at jamfpro.shopifycloud.com Analysed #1444682 Valid Cross-site Scripting Medium 2023-02-02 $9,400 240 IDOR on GraphQL queries BillingDocumentDownload and BillDetails Analysed #2207248 Valid Insecure Direct Object Reference Medium 2024-02-08 $5,000 187 Limited Privilege User Can Create Unauthorized Referrals on partners.shopify.com Analysed #1457471 Valid Access Control Medium 2025-03-20 – 181 XSS at https://exchangemarketplace.com/blogsearch Analysed #1145162 Valid Cross-site Scripting Medium 2021-04-09 – 174 GraphQL AdminGenerateSessionPayload is leaked to staff with no permission Analysed #898528 Valid No weakness recorded Medium 2020-07-16 – 173 [h1-2102] FQDN takeover on all Shopify wholesale customer domains by trailing dot (RFC 1034) Analysed #1086108 Valid Access Control Medium 2021-03-25 $3,100 166 Undocumented `fileCopy` GraphQL API Analysed #981472 Valid Access Control Medium 2020-10-22 $2,000 157 Stored XSS in SVG file as data: url Analysed #1276742 Valid Cross-site Scripting Medium 2023-01-31 $5,300 153 Informations disclosure - Access to some checkout informations Analysed #1064869 Valid No weakness recorded Medium 2021-03-13 – 150 User with removed manage shops permissions is still able to make changes to a shop Analysed #273099 Valid Access Control Medium 2020-06-12 – 145 [Information Disclosure] Amazon S3 Bucket of Shopify Ping (iOS) have public access of other users image Analysed #1021906 Valid Information Disclosure Medium 2020-11-21 $2,900 135 Create free Shopify application credits. Analysed #1257428 Valid Access Control Medium 2021-09-10 – 134 Reflected XSS In Marketing Reports Page On *.myshopify.com/admin Analysed #1754843 Valid Cross-site Scripting Medium 2025-04-15 – 128 Stored XSS in private message #729424 Valid Cross-site Scripting Medium 2019-11-08 $1,000 124 Reflected XSS in AI Chat Bot Greetings at help.shopify.com via Markdown Image Rendering Analysed #2509022 Valid Cross-site Scripting Medium 2026-06-18 $1,600 110 Admin panel Exposure without credential at https://plus-website.shopifycloud.com/admin.php Analysed #1417288 Valid Access Control Medium 2022-08-11 $2,900 109 Reflected XSS in *.myshopify.com/account/register Analysed #470206 Valid Cross-site Scripting Medium 2019-03-12 – 104 Bypass a fix for report #708013 Analysed #1363672 Valid Authentication Medium 2021-12-07 $3,500 102 Exposed Cortex API at https://cortex-ingest.shopifycloud.com/ Analysed #1258871 Valid Misconfiguration and Insecure Design Medium 2022-12-02 $6,300 101 Reflected XSS online-store-git.shopifycloud.com Analysed #1410459 Valid Cross-site Scripting Medium 2022-01-20 $3,500 98 Reverse Proxy misroute leading to steal X-Shopify-Access-Token header Analysed #429617 Valid Server-Side Request Forgery Medium 2019-03-14 $1,000 90 Add new development stores without permission Analysed #1167453 Valid Access Control Medium 2021-06-04 – 89 https://themes.shopify.com::: Host header web cache poisoning lead to DoS Analysed #1096609 Valid Denial of Service Medium 2021-04-08 $2,900 82 Blog posts atom feed of a store with password protection can be accessed by anyone Analysed #1256375 Valid Information Disclosure Medium 2021-11-08 – 76 Stored XSS in /admin/product and /admin/collections Analysed #1147433 Valid Cross-site Scripting Medium 2022-12-01 $5,300 76 Stored XSS in Discounts section Analysed #618031 Valid Cross-site Scripting Medium 2019-06-27 $1,000 75 Blind Stored XSS in shopify internal Parquet Viewer Analysed #1103298 Valid Cross-site Scripting Medium 2024-02-08 – 74 A staff member with no permissions can edit Store Customer Email Analysed #980511 Valid Insecure Direct Object Reference Medium 2020-10-22 $1,500 72 myshopify.com domain takeover Analysed #320355 Valid Input Validation and Logic Medium 2018-02-27 – 71 xss is triggered on your web Analysed #1121900 Valid Cross-site Scripting Medium 2021-12-06 – 69 A non-privileged user may create an admin account in Stocky Analysed #1245736 Valid Access Control Medium 2021-11-25 – 67 Staff without Manage Themes permissions can update themes Analysed #1550400 Valid No weakness recorded Medium 2024-01-23 – 66 Disclose customer orders details by shopify chat application. Analysed #968165 Valid Information Disclosure Medium 2022-05-14 $2,500 65 Xss triggered in Your-store.myshopify.com/admin/apps/shopify-email/editor/**** Analysed #1472471 Valid Cross-site Scripting Medium 2022-04-25 $2,900 63 Non-store owners can transfer Shopify-managed domain to another domain provider Analysed #1820953 Valid Access Control Medium 2024-01-17 – 58 Removing parts of URL from jQuery request exposes links for download of Paid Digital Assets of the most recent Order placed by anyone on the store! Analysed #1044285 Valid No weakness recorded Medium 2021-07-08 $2,900 58 authenticity token not verfied leads to change business name Analysed #994504 Valid Cross-Site Request Forgery Medium 2020-10-23 $1,900 54 Stored XSS at https://linkpop.com Analysed #1441988 Valid Cross-site Scripting Medium 2022-01-20 – 53 Staff who only have apps and channels permission can do a takeover account at the wholesale store (Bypass get invitation link) Analysed #1266828 Valid No weakness recorded Medium 2021-11-21 $1,600 53 Unauthenticated read and write access to ALL endpoints of a store is possible for removed staff members who had "Apps" permission Analysed #700831 Valid Input Validation and Logic Medium 2019-10-10 – 53 Cross-site scripting on api.collabs.shopify.com Analysed #1672459 Valid Cross-site Scripting Medium 2022-10-13 $1,600 51 ability to install paid themes for free Analysed #273557 Valid Access Control Medium 2018-05-16 – 50