protection against XSS attacks ...
XSS is an attack against the client side, not the server side where the DBMS resides. Thus the choice of DBMS does not matter here.
... and other similar attacks
I'm not sure what you consider similar attacks. But when talking about DBMS the main attack vector is SQL injection and in case of NoSQL DBMS like MongoDB NoSQL injection.
Does my choice of DBMS has a role in protection against ... attacks, or is it prevented only through only secure frontend and backend programming?
To protect against SQL/NoSQL injection you better make sure that you choose a DBMS where you don't need to construct query strings from user input but can use techniques like parameter binding - see bobby-tables.com for more details on this.
Apart from that you really should thoroughly verify all user input, and doubly so if your DBMS does not support things like parameter binding.