Comment by samuirai

Am I stupid or is this guy calling a XSS "Arbitrary Code Execution"? It also seems to be a self-xss (a XSS on his account profile, which only he can see).

How can you write so much text and be unclear about what you are doing? No wonder Paypal didn't understand anything.