> attacker has hacked the server and added javascript adding javascript doesn't necessarily mean the server is hacked. XSS attacks usually don't require actual

> attacker has hacked the server and added javascript adding javascript doesn't necessarily mean the server is hacked. XSS attacks usually don't require actually compromising the server. Or a malicious browser plugin could inject javascript onto a site.