Constant XSS attacks

Some creep has been trying to inject my site with XSS code for over a month now, and as you can see in the screenshot, amazing Wordfence keeps filtering the code out. However, there are some URLs he hits, like my ad widgets, wp-content-themes, and jetpack sharing icons that don’t say anything about any code being filtered out, so I’m worried he may be getting through.

My question is; is Wordfence completely protecting me from XSS injection, or there other steps I need to take?

http://postimg.org/image/dnzbe6j1t/

https://wordpress.org/plugins/wordfence/