The online game platform Steam is fixing a serious bug that could be exploited to redirect users to malicious websites and take over their profile. The XSS exploit on Steam Profiles has been only partially fixed, it seems that the flaw had been fixed only the initial activity feed pages, but it is still present on subsequent pages. The attackers can exploit the flaw by inserting JavaScript and other malicious code into their profiles, then the code is executed without any warning on the computers of anyone who visits the booby-trapped page.”]
Source: https://securityaffairs.co/wordpress/56090/hacking/steam-fixing-xss.html