3 ms·If you can inject JS then you can steal session cookies. Other stuff too, but XSS is a big deal.by d3c0d3dab0d3 13y agoIf you can inject JS then you can steal session cookies. Other stuff too, but XSS is a big deal.