The British Airways website breach appears to have been done through a cross-site scripting flaw, according to the chief executive of a Web automation company in the UK.