The PayPal Inc GP+ online service web application suffered from cross site scripting vulnerabilities.