[Kyle1995]

Lol I wasn't even pentesting the site, first section (under videos->comments) I typed in <a> and it disappeared and I was like ohhh shit.
Its a bunch of pure php and jquery api calls, unfortunately they do escape quotes, but not single quotes lol, who knows how many vulnerabilities are on there.
this was from the app btw, horribly coded.

[Gee4rce]

Wouldn't be surprised if there is even more than XSS as the coding seems outdated.

Code

http://www.chess.com/photos/?keyword=<scr ipt>alert('Hello..')</scr ipt>

(remove spaces to get it work).
Cheers, Gee.

[SIM-2914565]

hahaha i made it: bit .ly/1OPTGXY

(BTW bitly is also XSS vulnerable.. You can paste some codes in there, it only works on Client-side)

To make this done you have to do: https :// google .com/?q=YOUR_XSS_CODE