Cross-site scripting attack demo

I took advantage of Seed Labs' ELGG, a web application that was vulnerable. The ultimate goal of this attack is to spread an XSS worm among the users, such that whoever views an infected user profile will be infected, and whoever is infected will add me to his/her friend list.