XSS (Cross-Site Scripting)

Cross-site scripting (XSS) is an attack in which an attacker gets malicious JavaScript to run in other users' browsers on a trusted website. It happens when a site shows user input, such as comments, names or search terms, on a page without properly escaping it. The script can then steal session cookies, change the page or act as the user.

There are three main types: stored XSS (saved on the server, such as in a comment), reflected XSS (included in a link) and DOM-based XSS (created by client-side JavaScript). Defences include escaping output, avoiding innerHTML with untrusted data, a Content Security Policy (CSP) and HttpOnly cookies.