3D Secure is a fraud-prevention system:
3-D Secure XML-based protocol designed to be an additional security layer for online credit and debit card transactions. It was originally developed by Arcot Systems, Inc and first deployed by Visa with the intention of improving the security of Internet payments and is offered to customers under the name Verified by Visa.
And your concern:
NoScript informs me that it has stopped a potentially insecure script
It's most likely not an actual XSS attack.
This "XSS redirect" happens because the payment page on the website in question is redirecting you to a payment gateway. It is a redirect, yes, and it could be used to attack you yes, but!
- You should check for the green padlock in your URL bar on the website you're purchasing from. If there's no green padlock, do not even enter your details.
- When you submit the payment, you can see where it's redirecting you, as NoScript gives you a warning. Have you verified that the URL belongs to 3DSecure?
- Unless the attacker has access to your machine, and is able to modify the NoScript plugin to report the wrong URL, then you should be fine. However, if an attacker has access to your machine, there are bigger things you need to worry about.
Note that in many cases, ignoring the XSS redirect (refusing to "Unsafe Reload") still allows the payment to go through for me. I am unaware if this is the case on the website you're visiting.
As a customer, what risks am I exposed to by adding the merchant to the whitelist? Can someone steal my credit card details?
It really comes down to the security of each site.
If you use https, and the certificates are properly issued, a man-in-the-middle attack is highly unlikely.
These https certificates will validate that you are on the correct website while encrypting your connection to/fro. However, your data is only as safe as both websites that handle it. If there's a vulnerability in either website, even if the certificates are valid, it might be possible for your data to be stolen.
It's definitely possible for a website to be hacked, and for data to be gathered on the inside, and then accessed later on. However, most credit card companies promise zero fraud liability. Does yours? While this won't prevent your personal information from getting out, it at least offers some mitigation in the event of a breach.
Should I worry about NoScript's anti-XSS warning here?
It depends. Does everything check out? Green padlocks in your URL bar? Generally, there is no need to worry. However, if either of the websites in question are breached, then no... you can't trust either website at that point.