I think you may be misunderstanding parent's post. When you run a site with a strict CSP and a reportUri enabled, you will notice that you get tons of blocked scripts reported not because there is a vulnerability in your site, but because clients have installed tons of browser plugins that try to inject scripts into your site, and your CSP will block them.