This question already has an answer here:
Could TRACE METHOD cause harm to my website?
If this request is made:
TRACE / <script>confirm("Java Script !")</script> HTTP/1.1 Host: xxxxxdomain.com X-Wing: <script>bar()</script>
What can an attacker can do with this vulnerability?