This in itself would no be such news, were it not for the fact that this XSS flaw could be used to gather sensitive information.
"With border set to 0 in the tag, [the iFrame] could retrieve a deceitful seller central user login page that logs authentication credentials in cleartext and sends them to the fraudster's e-mail inbox," says one of XSSed's editors.
Here's hoping that Amazon reacts quickly.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.