With CPA + FB traffic on such a large scale, one could easy make $50k+ in a week with multiple CPA networks.
Knowing what little I do about the market for browser code execution vulnerabilities, I am very skeptical that there is a black hat market that pays 5 figures for XSS.