A script is able to obtain the name of any user who visits the page, their location (through IP or browser geolocation - on phones it can get the exact address), is able to keylog, and can effectively stay in the background even if the user goes to a different page. It would be possible for an external script to screenshot the browser window, track what pages are visited, and the script could replace payment processing forms with it's own forms, effectively being able to steal credit card information. There's also several social engineering exploits that would be possible like a fake LastPass login popup (to steal credentials/credit cards saved with it) or fake notifications (that can be used to download malware).
Would there be any legal liability for the corporation operating the site for being negligent in securing their site? Would any authors whose articles were changed, anyone who was defamed by an altered article,users whose private information/credit card info were stolen, or a government by able to file a claim against the corporation? Would there be any case law (in any common-law developed country) or EU law that would be applicable to this situation?