Theregister.co.uk XSS

Lately I've found a stored XSS on theregister.co.uk.
The xss can be used only by sending, via a POST request,
both values "job_function" and "other_job_function" (or both "job_sector" "other_job_sector")
in the -users' area-.
By sending a specific link we can excalate privileges with the automation of the reset of the victim's password.
Obviously the victim should be logged in!
A full video explaining how to get other accounts starting from the the stored XSS and a few CSRF

You can watch here a video explaining the problem and the simulation
of the hijacking of a session of a theregister's user.

Archived page on securitytube: http://archive.is/OgZlz


They have already replied to my email and solved the problem! Thumbs up for them.