its a free for all of targets known to be vulernable to javascript injection via some route or other?

And? They won’t be less vulnerable by not being listed, nor easier to find for any moderately skilled attacker (especially these days) by being listed publicly.