json xss scenario

json request
site.com/json.php?param=<xss can go here>

html page
script
json_url = site.com/json.php?param=shop
json = get_json(json_url)
parse_json (json)

I can't modify the json_url in the page as it is hardcoded. The html page has no XSS to manipulate the json_url once page is loaded. If I could I would have it request

site.com/json.php?param=<dom xss>

and that would be easy XSS.