Shopify · Report #111475
www.shopify.com XSS via third-party script
Validstatus
$500bounty
1upvotes
1 Feb 2016disclosed
Summary
Some pages on shopify.com, as well as some customer storefronts, were vulnerable to cross-site scripting because they pulled in vulnerable Javascript code from a third party via a <script> tag. The third party corrected the bug shortly after they were notified.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.