Cross-site scripting is very dangerous because it is not visible for the user. Users can accidentally trigger the XSS payload if they visit an affected page.