Here is an example of a WMS from my config file...
<layer label="NWS RADAR" type="wms" autorefresh="66" skipgetcapabilities="true" url="http://mesonet.agron.iastate.edu/cgi-bin/wms/nexrad/n0q.cgi" version="1.1.1" visible="false" visiblelayers="nexrad-n0q-900913" alpha=".5"/>
That is a RADAR layer I'm getting from the University of Iowa. Here is one of my own...
<layer label="COUNTY BOUNDARY" wkid="3857" type="wms" skipgetcapabilities="true" url="http://maps.ironcountywi.org:8888/cgi-bin/mapserv.exe?map=C:/Projects/county_webmerc.map" version="1.3.0" visible="true" visiblelayers="COUNTY"/>
My layer is in lat-lon, so I added the [wkid="3857"] entry to request the correct projection.
If you have the [skipgetcapabilities="true"] entry, then it doesn't need a cross-site script.