It's funny how you guys go gaga about it. Cookie grabbing isn't new in Neopets at all. Idiotproof and company first made the cookie grabber famous in Neopets 3 years back. Much more was hacked as many still used the IE 5.x and older versions which are vulnerable. IE 6 and Firefox are protected against XSS (document.cookie) as far as I know.
Anyways, kudos to whoever who found a new way to inject the exploit into userlookup.
What the CENSORED? I thought Neopets blocked all suspicious code and Javascript? It's impossible to inject a cookie grabber into user lookup/petpage last time.