Vulnerability type xss uncovered in airbnb.es

How it was found

The vulnerability is exploited doing an upload of the file (Exploit) attached in this conversation as profile photo.