Shopify · Report #854299

Self XSS in Timeline

Validstatus

16upvotes

25 Aug 2020disclosed

How it was found

Copy the url javascript: XSS payload to any Timeline, then click url will trigger XSS.

{F796167} {F796161}

I previously reported a storefront url XSS at #841361, then admin copy the url to Timeline is possibly.

Self XSS

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original