There was no cross site scripting here.  It should not be possible without CORS.  It looks like he just copy pasted some content from elsewhere.  I am surprised it worked!  Anyways - I always get excited to discover new bugs like this for me to fix.  :)

Wiem, raczej chodziło "co odwalasz człowieku?" :D