The core

XSS is your page running the attacker's JavaScript.

If attacker-controlled text reaches the browser without being neutralised, the browser can't tell it from your code — and runs it with your site's full privileges.