The exploit I read in the vice.com article is the attackers username or a post could contain "<img src=/signout>" and be unescaped and automatically sign users that loaded that page out. If you don't want to call that an XSS, what would you like to call that?

The claim regarding username is 'i can make my username "signout" and it signs people out when they click my profile', not that it can contain <img src=/signout>, so no html injection here.

Visiting https://superlogout.com/ logs you out of gmail with a cross-site GET request and it's not considered a vulnerability by google [0]

Posts could contain a safe subset of html (no scripting) including <img> as a feature - that used to be an acceptable design choice. In connection with the /signout it did allow for some unfortunate shenanigans - the kind of bug you just add additional sanitization for and move on, nothing indicative of a below average code quality.

>If you don't want to call that an XSS, what would you like to call that?

I would call the version you described a HTML injection to CSRF, but as Dylan16807 noted apparently it does fit OWASP's wide definition of XSS: "Since then, the term has widened to include injection of basically any content." [1] But that's not what happened, there was no HTML in usernames and HTML in posts was intended.

[0] https://bughunters.google.com/learn/invalid-reports/web-plat...

[1] https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Sc...

> OWASP considers the term cross-site scripting to be a misnomer. It initially was an attack that was used for breaching data across sites, but gradually started to include other forms of data injection attacks.[2]

Oh.