Cross-Site Scripting (XSS)

XSS occurs when an application places untrusted input into a page or browser operation in a way that lets it run as code rather than remain data. Depending on the application and context, this can expose account information, manipulate page content or perform actions in a user's session. Security guidance distinguishes stored, reflected and DOM-based patterns, although the protection needed depends on where untrusted data enters the browser.

A review form is one possible risk: comments saved to a database must not become executable markup when another user views them. Developers should rely on safe framework behavior, apply context-appropriate output encoding, sanitize HTML when rich content is genuinely required and avoid unsafe script-evaluating operations. Security headers such as Content Security Policy can provide a complementary layer but are not a replacement for correct output handling.

XSS is not the same as cross-posting content between social networks or cross-site request forgery (CSRF). A content editor can reduce risk by maintaining trustworthy plugins and limiting administrative access, but code-level prevention belongs to the application and its developers. Scanning alone cannot certify that a site is free of XSS.