XSS exploit documentation is outdated

[agardnerIT]

The XSS exploit documentation reads like:

• I login as user1 eg. admin and add the <button> to my profile
• I am redirected back to my profile and shouldn't see the button
• A different user eg. user2 visits my profile and can see the button

However, at step 2, I can see my own button?

[W3D3]

Good catch, you're right, the docs are outdated.
Previously you would just see your bio in the text field to edit and it would not get rendered.
We silently changed that a while ago because it was so annoying to switch users to show off the XSS / see how the bio gets rendered.