Knowing what little I do about the market for browser code execution vulnerabilities, I am very skeptical that there is a black hat market that pays 5 figures for XSS.