Create an ad and save the following in the "Terms of trade" or "Payment method info" markdown fields. The XSS will run when the user navigates to the ad or in the trade screen. You can also navigate to https://localmonero.co/account/settings and save it in the "Personal Introduction" field, so the XSS runs when the user navigates to your user profile page.