PayPwn: Another Two Paypal Stored XSS’s

How can PayPal let this kind of thing go un-noticed? Do they not do code review? Have security guidelines!? It's crazy.