There are primarily two kinds of XSS-Attacks: Persistent and ad-hoc.
A private Browsing session will protect you from ad-hoc XSS attacks, but not from persistent attacks.
A persistent XSS works by an attacker injecting script-code somewhere into the sensitive page, this could be done by sending you a prepared message on the platform, or by some other means of injecting data into the storage of the sensitive page. When you log into the sensitive page to view some data, the injected data will be loaded by the server and transferred to your browser and will be executed if the site is vulnerable. An example would be a prepared message in an online-banking transaction. The attacker would send you a real transaction and the message-part would contain harmful script. No other page is involved so you cannot protect yourself against this, only the page-owner can.
An ad-hoc XSS can work by getting you to click on a prepared link, which includes injection-data. Such a link could look like