Cross-site scripting (XSS) is a web application vulnerability that lets an attacker inject malicious script into pages that other users view. Because the script runs in the context of the trusted site, it can read data, act as the user or change what the page shows. OWASP describes XSS as a type of injection, and it is catalogued as CWE-79.

How it works

• Reflected XSS: the payload sits in a link or form, and the site echoes it straight back in the response.
• Stored XSS: the payload is saved by the site, for example in a comment or profile, and runs for every visitor.
• DOM-based XSS: the page’s own JavaScript writes untrusted input into the page without making it safe.

In each case, the root cause is user input that reaches the page without proper encoding or validation.

Why it matters for defenders

XSS can be used to steal session data, enabling session hijacking, or to show fake login forms on a real domain. Defenses include context-aware output encoding, input validation, frameworks that escape output by default, a Content Security Policy and cookies marked HttpOnly. Regular testing of public web applications, as part of managing the external attack surface, helps find these flaws before attackers do.

Sources: OWASP: Cross Site Scripting (XSS), CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)