This question already has an answer here:
I understand why allowing arbitrary JS code enter persistent storage (e.g., in a database table that contains user comments) is a huge vulnerability since it may end up being served to other users.
But let's say the unescaped user input is never used or stored anywhere apart from being substituted into the HTML response immediately sent back to the same user? Does this open any vulnerability?
In other words, is there any harm in sending back to the user the HTML response that contains (in the worst case) arbitrary JS code created by the same user?