DOM XSS on PayPal's Main Domain
A payload placed in the URL fragment reached a DOM sink on PayPal's main domain and executed; PayPal closed the report as a duplicate.
DOM XSS
The server never sees the payload. It goes from the URL into a DOM sink and fires in the browser.