[Noumenon72]

My understanding of persisted XSS attacks is that it's not that the site is malicious, but that it had security holes, so other people who got through the captcha uploaded malicious scripts. Now the site is serving them unawares. Does that sound right?

[ollien]

Correct. If it were malicious on the part of the site, they could just send you that javascript anyway.