Do corporations have any legal liability for XSS exploits that can harvest private/payment info?

Question

So let's say there's a website that is made up of crowd sourced articles (let's say it's about politics). The website has users from around the world. All articles have to be approved by an editor, although the website can have articles with opposite viewpoints. This site also allows comments to be made, however, the comments are not sanitized in the server (which is essentially security 101), so javascript code and external scripts, and style can be included in the comments and executed by any user when loaded. This means that any user can effectively change the contents of the articles, headlines, or any text/links/images in the webpage. This means that an article could be turned into an attack piece against a politician or controversial CEO when it was actually about something else, and it would appear that the original author wrote that. Comments can also be changed as well. This means that one comment could be used to insert a script that promoted fake news (like stock market manipulation - "Elon Musk arrested by the FBI or operating a $10b cocaine ring" / "Company A's study is a failure" / "Trudeau on the run from RCMP for embezzlement of $2B.").

A script is able to obtain the name of any user who visits the page, their location (through IP or browser geolocation - on phones it can get the exact address), is able to keylog, and can effectively stay in the background even if the user goes to a different page. It would be possible for an external script to screenshot the browser window, track what pages are visited, and the script could replace payment processing forms with it's own forms, effectively being able to steal credit card information. There's also several social engineering exploits that would be possible like a fake LastPass login popup (to steal credentials/credit cards saved with it) or fake notifications (that can be used to download malware).

Would there be any legal liability for the corporation operating the site for being negligent in securing their site? Would any authors whose articles were changed, anyone who was defamed by an altered article,users whose private information/credit card info were stolen, or a government by able to file a claim against the corporation? Would there be any case law (in any common-law developed country) or EU law that would be applicable to this situation?

Answer 1

Would there be any legal liability for the corporation operating the site for being negligent in securing their site? YES. (where a company is not able to ensure it's services are Secure while assuring Confidentiality and Privacy it becomes liable for the consequences that derive from the Service).

Would any authors whose articles were changed, anyone who was defamed by an altered article, users whose private information/credit card info were stolen, or a government by able to file a claim against the corporation? YES. (in addition to the previous answer content, where impact either breaches a country law or it had a documented impact on several of its citizens, the country may take legal action against the company).

Would there be any case law (in any common-law developed country) or EU law that would be applicable to this situation? YES. (several in fact... ranging from ePrivacy and GDPR to common market laws and civil regulations).