If you include dynamic content on your web pages (i.e. things submitted by other users or content submitted via form fields) and that content is not cleaned of such things as JavaScript and HTML, then it is possible that people could make arbitrary content appear on your web site, capture data from your users, and worse.