It seems that someone has inserted javascript code in their profile. That page is full of javascript message boxes saying "xss1", "xss2" etc.