I'm struggling with X-Script attacks. I think I understand what they are but it's unclear if they only affect public facing web pages (which I will define better).
My question is, can X-Script attacks still be dangerous if only the user who set's it can have access to it (if it's hidden behind a login)?
I am excluding SQL injection for this question please.
For example, consider a simple website that allows a user to login and see a list of comments they've made. They can't share their comments with anyone and only the logged in user can see the comments. The user can add any code they like here. As such, any malicious code they add will only affect that logged in user!
Do I still need to be concerned about X-script attacks on this type of website?