Here's a forum of sites with XSS flaws. Verify for yourself. If you can stand the terrible language and tangents.
Sites with XSS Flaws
It is a small credit union. Needless to say I am in the process of changing banks.