[nsx147]

Some Uber intern probably made that form and didn't know what sanitizing inputs was about. Good find - but easy fix. You usually can't get away with XSS attacks anymore

[uberhacked]

Uber told me they used WordPress to build their petition sites. Maybe other WordPress sites are vulnerable?

[noeltock]

WordPress has plenty of functions to sanitize, the one who made the theme or dropped in the form probably overlooked it.