Virtually every stream cipher is based on the idea of generating a keystream and adding it to the plaintext with XOR. XOR is also used to combine round keys with plaintext in the round functions of block ciphers and hashes.

If you can generate a secure keystream (for instance, from pure random data well in advance of your message encryption), you can use just XOR and nothing else, and that system will be difficult to attack mathematically.

XOR as a concept gets an unjustified bad rap amongst generalist engineers because of all the terrible Rube Goldberg XOR schemes other developers have come up with. It's authentically essential to strong cryptography, but very easy to misuse in weak crypto.