Regardless how static a site is attackers are free to inject any script code they wish in the HTML page on Http.