Risk analysis/management is not "I'm going to leave this vulnerability unpatched because it hasn't been actively exploited yet." In most cases it is preferable

Risk analysis/management is not "I'm going to leave this vulnerability unpatched because it hasn't been actively exploited yet." In most cases it is preferable to lock your door before someone has robbed your house. In any case, receiving hundreds of XSS reports per week is weird. Unless you're isolating the context where XSS is happening from the user session, 3rd-party XSS is a serious vulnerability. At the very least it means data exfiltration. Unless your app doesn't have user data worth exfiltrating, I'm surprised your company wouldn't take those reports more seriously. But again, you do that risk assessment by asking "what could this lead to and what information is at risk", not by saying, "this is fine to leave until it turns into a zero day."