GAuth 0.9.9 beta has stored XSS that shows a popup repeatedly and discloses cookies.

Source