BillMeLater: XSS Through a Style Attribute
A Firefox-only reflected XSS on wwwb.search.billmelater.com, achieved by closing out of a style attribute and injecting a fresh script element, which the vendor classified as out of scope.
Vendor response
What actually happened after I hit send. Prezi fixed it inside two days. BillMeLater closed mine as out of scope.
2014
Stored XSS in Three WordPress Chat Plugins
WP Live Chat Support, MyLiveChat and Provide Support all accepted stored cross-site scripting during a 2014 customer install.
Chrome backslash URLs and XSS filter bypass
Chrome resolves and executes a script URL written as http: followed by any number of backslashes. Firefox does not, and that difference can slip past pattern-matching XSS filters, closed by Chromium as wontfix.
Path Traversal on map.prezi.com ($1,000)
A path traversal issue on Prezi's map.prezi.com subdomain, fixed within two days of reporting and rewarded with a $1,000 bounty.