On October 13, 2026, an attacker used Selleasy to add a phishing script to some Shopify stores running the app. Selleasy says "an unauthorized script was injected into some of the stores we serve, which redirected customers to a phishing page outside our environment." Its incident page says the attacker accessed an internal tool and added the script to stores' Selleasy settings between 07:47 and 15:00 UTC.
Selleasy says it fixed the root cause within hours, found no evidence of a breach of its own systems, and considers the app "safe to use." As of October 20, it's still unavailable on the Shopify App Store.
Hulk Product Options and Swym Wishlist Plus confirmed similar attacks that week. Shopify also disabled Boost AI Search & Filter over a security issue. Qikify had a separate incident in July: malicious code was added to two HTML fields in its app settings through a leaked credential. Qikify says it resolved that incident in August, and it wasn't part of the October wave. Our summary of the October incidents covers each one.
Why upsell apps are a target
Upsell and cross-sell apps sit near the cart and checkout button. Most let merchants customize widgets with HTML or scripts. These attacks used that combination: a vendor-side settings field running code on every store page near checkout.
Check your store now
- Test checkout the way a shopper would. Open a private window, add a product, accept an upsell if one appears, click Checkout, and confirm you land on your real checkout. Repeat in fresh windows.
- Check your upsell app's settings for custom HTML or JavaScript. Remove what you don't recognize.
- Turn on two-factor authentication for every Shopify staff and collaborator account, and for your upsell app's login.
- Know what upsells are worth to you. Check how much revenue your upsell widgets drive, so you know what's at stake if you turn the app off.
- If you're on Selleasy and its embed was switched off, Selleasy says you can turn it back on. Run step 1 again afterwards.
Option 1: Upsells Shopify does natively
- Product recommendations: your theme's "You may also like" sections use Shopify's recommendation engine, free.
- Complementary products: in Shopify's Search & Discovery app, you choose which products to suggest alongside each product.
- Bundles: Shopify's free Bundles app handles fixed bundles and multipacks.
- Checkout upsells (Plus): checkout extensions can show offers in checkout itself, on Shopify's own secure checkout.
For many stores, complementary products and a well-placed cart recommendations section cover most of an upsell app's work.
Option 2: Another upsell app
These were listed on the Shopify App Store when we checked on October 24, 2026, and all four carry Shopify's Built for Shopify badge. We haven't security-audited any of them.
- Frequently Bought Together by Code Black Belt: "bought together" recommendations on the product page, with bundle discounts.
- LimeSpot: AI recommendations, cart upsells and bundles.
- Upsell.com (formerly ReConvert): offers on the product page, cart, checkout and thank-you page. It left the App Store briefly in October and is back.
- One Click Upsell by Zipify: pre- and post-purchase offers.
Before installing any of them, ask:
| Question | Why it matters |
|---|---|
| Can HTML or scripts be added through your dashboard? | That's how both the Selleasy and Qikify incidents ran. |
| Who on your team can change our store's settings, and is it logged? | Selleasy's attacker got in through an internal tool. |
| Do you support two-factor authentication on every account? | Qikify traced its incident to a leaked credential. |
| What happens to our cart and checkout if your servers go down? | An upsell widget failing quietly is fine. A broken cart is not. |
| Can you show revenue from your widgets, measured the same way Shopify measures it? | So you can compare against native options fairly. |
Option 3: Build upsell logic you own
Business-specific upsell rules, such as offers by order value or customer group, can live in your theme and Shopify itself. Shopify supplies recommendations, while your theme or a Shopify Function handles offer rules. No vendor dashboard can add code to your cart page.
Talk to us about custom Shopify app development
Before you change anything: an App Risk Audit
Black Friday is November 27. Most stores freeze code a couple of weeks before. Our App Risk Audit maps every app on your store, identifies which can run code from their own dashboards, tests what breaks when each fails, and provides a written fallback plan for each critical app.
Book an App Risk Audit before Black Friday
FAQ
Is Selleasy safe to use now?
Selleasy says yes, based on its investigation so far. It's still unavailable on the Shopify App Store as of October 20, 2026. Check your settings, turn on 2FA, and test checkout.
Was customer data stolen from Selleasy?
Selleasy says it found no evidence of a backend or database breach. Shoppers risked entering details on a phishing page after being redirected during the attack window.
Was Qikify part of the same attack?
Qikify says no. Its July incident was resolved in August.
Can I upsell on Shopify without an app?
Yes. Product recommendations, complementary products and bundles are free. Plus stores can add checkout upsells.
