PayPal suffered from a cross site scripting vulnerability in the merchant directory functionality.