Your question is Explaining XSS Risk to Developers. Take a moment with it on the right.
Talk me through your thinking if you like. When you're confident, submit your answer and I'll grade it like a real screen (7/10 or better passes).
How would you explain the risk of a Cross-Site Scripting (XSS) vulnerability to a developer who is resistant to fixing it?
Keep your answer focused on the security impact, not the code fix. Explain how you would frame the risk, what concrete abuse cases you would use, and how you would respond if the developer argues the issue is low severity or only affects their own page. If helpful, mention how you would verify the vulnerability and prioritize remediation.