2.1.1 XSS
Stored, reflected, or DOM XSS. <script> in a comment that you render with innerHTML.
Why it matters
Session theft, fake UI, malware. Your domain's trust is used against the user.
How it is used
Encode on output. CSP. Avoid dangerouslySetInnerHTML unless sanitized. HttpOnly cookies so stolen JS cannot read the session cookie.