Some might argue that XSS is not immediately obvious, since it involves attacks in
which the victim is another user instead of the server. Many others might argue that all
XSS is unforgivable. However, it’s been well-known for 5 years and is a staple of any
basic primer on web application vulnerabilities. XSS probably has a larger attack surface