can we block Cross-site scripting (XSS) in LTM

One could probably hobble something together in an iRule (there might even be some iRules for that in the codeshare area). Here is an example someone suggested.

This is really what ASM is for, however. That is tested and maintained. Rolling your own might work in some or even a lot cases, but it'll sign you up for maintaining it, which I wouldn't suggest.