Cross-Site Scripting (XSS)
Cross-site scripting (XSS) is a vulnerability where an attacker injects malicious scripts into a web page that then execute in other users' browsers, letting them steal sessions, credentials, or perform actions as the victim. It happens when untrusted input is rendered into a page without proper encoding.
Cross-site scripting (XSS) occurs when an application includes untrusted data in a web page without correctly encoding or sanitizing it, so the browser executes attacker-controlled JavaScript in the context of the trusted site. Because the script runs with the victim's session, it can read cookies, hijack accounts, log keystrokes, or make requests on the user's behalf.
XSS comes in three main forms: stored (the payload is saved server-side and served to every viewer), reflected (the payload is echoed back from a request, often via a crafted link), and DOM-based (client-side JavaScript writes untrusted data into the page). The core defense is contextual output encoding — HTML-encoding text, attribute-encoding attributes, and treating data as data — plus a Content Security Policy and safe DOM APIs like textContent instead of innerHTML.
Tracked as CWE-79 and part of the OWASP Top 10 injection category, XSS is one of the most common web flaws. Static scanners detect it by tracing tainted input from a source (like a request parameter) to a sink (like HTML output) without a sanitizing step in between.