WHY XSS PERSISTS IN THIS FRAMEWORKS ERA?

Summary from the TLDR InfoSec newsletter

Modern frameworks block most HTML XSS through automatic escaping, but XSS persists when developers bypass protections with WYSIWYG editors, markdown parsers, or flawed sanitizers. Frameworks don't guard against JavaScript XSS via URL attributes (href/src with javascript:) or eval in OAuth flows, redirects, or postMessage. Even trusted libraries may cause XSS if misused, and defenses like CSP and WAF are often bypassed, so developers must treat all input as untrusted and reliably use protections.