More than 1000 people were inside when two Russian missiles slammed into the mall in Kremenchuk, about 300km southeast of the capital Kyiv, Ukrainian President Volodymyr Zelenskiy said.
At least 18 people were killed and 25 hospitalised, while about 36 were missing, Poltava region governor Dmytro Lunin said.
Zelenskiy, in an overnight video address, called the attack deliberate, saying it was "a calculated Russian strike exactly onto this shopping centre".
Russia said the incident was caused by a strike on a legitimate military target. Its defence ministry, quoted by the RIA state news agency, said it had fired missiles at a storage depot for Western weapons in Kremenchuk, and the detonation of stored ammunition there had caused the fire at the nearby mall.
Ukraine's Prosecutor General Iryna Venediktova told Reuters a missile had also struck a nearby factory, but it was closed and not a military target.
"It's a question about crimes against humanity," she said. "I think it's like systematical shelling of civilian infrastructure - with what aim? To scare people, to kill people to make terror in our cities and villages."
Relatives of the missing lined up at a hotel across the street where rescue workers set up a base after Monday's strike.
A survivor receiving treatment at Kremenchuk's public hospital, Ludmyla Mykhailets, 43, said she was shopping with her husband when the blast threw her into the air.
"I flew head first and splinters hit my body. The whole place was collapsing," she said.
"It was hell," said her husband, Mykola, 45, blood seeping through a bandage around his head.
Leaders of the Group of Seven (G7) major democracies, at a summit in Germany, said the attack was "abominable".
"Russian President Putin and those responsible will be held to account," they said in a joint statement.
The UN Security Council, where Moscow wields a veto, will meet on Tuesday at Ukraine's request following the attack.
Elsewhere on the battlefield, Ukraine endured another difficult day following the loss of the now-ruined city of Sievierodonetsk.
Russian artillery pounded Lysychansk, Sievierodonetsk's twin city across the Siverskyi Donets River. Ukraine said the Russians attempted to storm it.
Lysychansk is the last big city held by Ukraine in eastern Luhansk province, a main target for the Kremlin after Russian troops failed to take Kyiv early in the war.
Eight residents including a child were killed and 21 wounded by shelling when they gathered to get drinking water in Lysychansk on Monday, Luhansk Governor Serhiy Gaidai said.
Ukrainian forces controlled the city but its loss was possible as Russia poured resources into the fight, he added.
"They really want this and a lot of reserves are being thrown just for this...We do not need to lose an army for the sake of one city," he told Reuters in an interview.
Rodion Miroshnik, the ambassador to Moscow of the separatist Luhansk People's Republic, said Russian troops and their Luhansk Republic allies were advancing westward into Lysychansk and street battles had erupted around the city stadium.
Russia also shelled the city of Kharkiv in northeast Ukraine on Monday, hitting apartment buildings and a primary school, the regional governor said.
The shelling killed five people and wounded 22. There were children among the wounded, the governor said.
During their summit in Germany, G7 leaders vowed to stand with Ukraine "for as long as it takes" and tighten the squeeze on Russia's finances with new sanctions that include a proposal to cap the price of Russian oil.
