Since when did CSRF and open redirect exploits become serious? Quite common and minor really.
It was an XSS, which has been considered high priority by most people for a while: https://bugcrowd.com/vulnerability-rating-taxonomy
As he mentioned in the write-up I linked, you could use this for both retrieving data and performing actions.