Comment by harryh

The fact that they're using a GET is not the problem (though it is slightly bad). The malicious javascript would have to be only slightly more complex if it was a POST. The issue is that there is no security token required when making the request to do the status update.