I found two Shopify plugin vulns with GLM-5.3 Flash