JavaScript doesn't have XSS. The DOM allows for XSS vulnerabilities, but that's an API, not the language.