Security consultant says two-thirds of sites are vulnerable to cross-site script attacks, and about half are never fixed A majority of Web sites have at least one major security issue that could be ...