I read the article that this story links to and spent the next few minutes laughing and yelling at my screen. The description of how the XSS works "by sending the user to a different site, that steals their session cookie", that is wrong! The 'other' site doesn't have access to your cookies!!

Then in the paragraph after the example they say that this approach is used in SPAM emails too! "A user is sent an email saying that their account has been compromised and they need to click a link fix it, but the link directs them to a different evil page." That isn't a XSS that is a Phishing SPAM!

And where in the article does it suggest a fix? It doesn't. NW, did you actually read this article?