tl;dr - found an XSS via HTML injection on an Uber petition page. What they did was a pretty basic XSS attack. The fact they were successfully able to do this

tl;dr - found an XSS via HTML injection on an Uber petition page. What they did was a pretty basic XSS attack. The fact they were successfully able to do this is a major problem for Uber basically. Not escaping arbitrary user input you're showing is not something that should ever go to production. This is pretty embarrassing. It happens, but facilitating code review, pen testing (even automated pen testing) and QA should definitely catch it. Update: Based on more data from the author this is a faulty Wordpress plugin which they used.