PayPwn: Another Two Paypal Stored XSS’s (henryhoggard.co.uk)

How can PayPal let this kind of thing go un-noticed? Do they not do code review? Have security guidelines!? It's crazy.