The websites of both Democratic presidential candidates have been hit by cross-site scripting (XSS) exploits.