“However, in this case, TinyMCE was up-to-date and had been configured correctly not to allow scripting tags and attributes.”
Chess.com has over 100 million members and one rich text editor shared across forums and blog comments. The editor was patched and configured right, and it still let script through. A hobbyist found it in his spare time. The writeup waited out a nine-month disclosure window, and the bounty comes with no number attached.