[_RPM]

Oh I see. This makes sense. This doesn't seem challenging to prevent. A simple replacement of characters on the HTML entity table would have prevented this instead of putting arbitrary text onto standard output.

[finnn]

Correct. The purpose of this post is to demonstrate yet another class of website that does not validate user input.

[0x0]

Yep, missing that is what makes this an "XSS" :)