Shopify · Report #1472471
Xss triggered in Your-store.myshopify.com/admin/apps/shopify-email/editor/****
Validstatus
mediumseverity
$2,900bounty
63upvotes
25 Apr 2022disclosed
How it was found
Hi team,
I have found Store Xss in shopify-email
#Reproduction Instructions /
1.Configure shopify-email for Shopify stores at https://apps.shopify.com/shopify-email
2.Goto Your-store.myshopify.com/admin/apps/shopify-email/template-branding
3.Change F1607675 with "><img src=xx onerror=alert(document.domain)> click Save.
4.Now Select any F1607682.
#██████████
#Proof of Concept ███ ████
Impact
Stored XSS triggered.