"If you do not take care of your web application vulnerabilities, someone else will." The worm executes and propagates itself exploiting XXS vulns, so the only limitation to its spreading is bound to the presence of a XSS vuln inside the webmail domains.
