XSS vulnerabilities are very popular, there have been many instances when very big companies have had these issues. Like passwords and user information has been quietly stolen and so on. Facebook, Youtube, Gmail, and many other big companies have had XSS vulnerabilities. Look at The article WebARX has written about XSS and find a good example of XSS vulnerability in WordPress 4.8.