As far as I can tell they're not having problems with XSS. The listing description is actually an iframe served from a different domain with no access to anything on the eBay website. This appears to be a straightforward phishing attack.
So, if I were to go to such a site with noscript activated, I would be okay? I mean, noscipt would probably set up to allow ebay.com so the site actually works, but this different domain will most likely be blocked, yes?