xss

Cupid’s Matchmaker

Stored XSS in a matchmaking survey steals the reviewer’s session cookie and exposes the flag.