A cross-site scripting flaw in the PayPal Web site allows a new phishing attack to masquerade as a genuine PayPal login page with a valid security certificate, according to security researchers.

A cross-site scripting flaw in the PayPal website allows a new phishing attack to masquerade as a genuine PayPal log-in page with a valid security certificate, according to security researchers.