How do cookies relate to XSS?

The answer

Injected script can read every cookie that is not HttpOnly and send it to an attacker, so session cookies should be marked HttpOnly. Even then, the script can make authenticated requests, because the browser still attaches the cookie. HttpOnly therefore limits theft but does not stop the attack. MDN defines XSS as getting a site to run malicious code as though it were its own, and the real fix is preventing injection through output encoding and a content security policy.