Cross-Site Scripting (XSS)

What it is

Cross-site scripting, or XSS, occurs when attacker-controlled content executes as browser code within a trusted site's context. It can modify pages, capture entered information, or perform actions using the user's session. Stored XSS persists in site content, reflected XSS appears in a response to a request, and DOM-based XSS arises from unsafe browser-side handling.

How it works

Untrusted content reaches an executable HTML or script context through unsafe rendering or DOM operations. A victim views the affected page and their browser runs the code under the site's origin. HttpOnly cookies can prevent direct script reading of those cookies but do not prevent the script from making authorized in-page requests.

How people get tricked

A trusted site or a familiar shared link supplies the malicious content. Developers may assume input validation is enough without considering where the value is rendered. Different output contexts require different safe handling.

Example scenario

A site renders user profile content as unsanitized HTML. Visiting an affected profile runs attacker-controlled code that inserts a fake sign-in form inside the genuine site.

Warning signs

• Unexpected scripts or interface changes in user-controlled content.
• Browser security reports or unusual requests after viewing particular pages.
• Unsafe HTML insertion or script-capable DOM APIs in code review.

If it happens to you

Remove malicious stored content and fix the rendering path. Determine which users viewed it and what actions or data were exposed; revoke sessions where appropriate. Inspect other output paths sharing the same assumption rather than only deleting the reported payload.