Reading up the XSS attacks on wiki I see that it says an injected script could send data/cookies to the attackers site. How is this achieved? Are there no checks/restrictions on cross origin requests like this from a browser? I thought the CORS spec was specifically done for this purpose and the original site must set the "helper" sites in the Access-Control-Allow-Origin header. Am I missing something or is it not needed? Can I just do a HTTP post to any server from any page?
EDIT: I think I answered my own question here. The injected script can fetch code from the attackers site thus making it run within the original site's code. That makes the attackers site ok to post to. Is this correct? Any other information welcome.