Common Ecommerce Vulnerabilities: Reflected XSS

This write-up describes a reflected Cross‑Site Scripting (RXSS) vulnerability in Shopify Collabs where an unsanitized creator_redirect parameter allowed javascript: URLs to execute in authenticated users' browsers; the post covers the PoC, potential impacts on customer accounts and data, and recommends server-side input sanitization and allowlisting of approved https:// redirect domains — the issue was responsibly reported and fixed.