Overview
Direct Answer
Cross-Site Scripting (XSS) is a web application vulnerability that enables attackers to inject malicious JavaScript or HTML code into web pages, which executes in the browsers of legitimate users who visit the compromised or attacker-controlled site. This injection occurs when user input is rendered without proper sanitisation or encoding.
How It Works
An attacker crafts malicious script payloads and submits them through vulnerable input vectors—such as search fields, comments, or URL parameters—which the application stores or reflects back to other users. When a victim's browser loads the page, the injected script executes within their session context, granting the attacker access to session cookies, authentication tokens, or the ability to perform unauthorised actions on behalf of the user.
Why It Matters
XSS attacks directly compromise user trust and organisational reputation, exposing sensitive customer data and enabling credential theft. Enterprises face regulatory compliance penalties under data protection frameworks and operational costs associated with incident response, remediation, and potential legal liability.
Common Applications
XSS vulnerabilities are prevalent in web applications including content management systems, social media platforms, email services, and e-commerce sites where user-generated content or query parameters are processed. Attackers exploit these vectors to harvest credentials, distribute malware, or launch phishing campaigns targeting end-users.
Key Considerations
Effective mitigation requires both client-side defences (Content Security Policy headers) and server-side protections (input validation, output encoding, templating engines). Context-aware encoding and strict separation of code and data are essential, as different encoding schemes apply depending on whether content appears in HTML, JavaScript, or URL contexts.
More in Cybersecurity
Information Security
Security GovernanceThe practice of protecting information by mitigating information risks including unauthorised access, use, and disruption.
Security Operations Centre
Defensive SecurityA centralised facility where security professionals monitor, detect, analyse, and respond to cybersecurity incidents.
Security Audit
Security GovernanceA systematic evaluation of an organisation's information system security by measuring compliance with established criteria.
Security Information and Event Management
Offensive SecurityTechnology that aggregates and analyses security data from across an organisation to detect threats.
Denial of Service Attack
Offensive SecurityAn attack designed to make a machine or network resource unavailable by overwhelming it with traffic.
Runtime Application Self-Protection
Offensive SecuritySecurity technology embedded within applications that detects and blocks attacks in real time by monitoring application behaviour and request patterns during execution.
Supply Chain Attack
Offensive SecurityA cyberattack targeting the less-secure elements of a supply chain to compromise a primary target.
Adversary Simulation
Offensive SecurityAdvanced red team exercises that replicate the tactics, techniques, and procedures of specific threat actors to evaluate an organisation's detection and response capabilities.