It doesn't matter if they are directly stealing cookies though.

Are you thinking of NoScript? That's what gives me the XSS popups.

I agree, the old name was more fun.

uBlock prevents XSS? I didn't know that.

This seems like a really basic vulnerability that whoever wrote the code to do that probably should have been aware of. It concerns be about the security of the rest of Lemmy if they're making such basic errors.