XML is to authentication bypasses what C is to buffer overflow attacks
XML could really benefit from a standardized subset that cuts out all the unnecessary features and security footguns.
I find that the "unnecessary features" and footguns are what makes XML, well, XML. I guess there must be some legitimate usage of those, or at least was back in the day. If you strip them out, you'd end up with a JSON-like (so you may as well use JSON).