Sorry. When you see XSS, you exploit. There really isn't any choice in the matter.