Cross-Site Scripting (XSS)
Definition
In Cross-Site Scripting, foreign active code is executed in the context of a trusted website.
A vulnerability where untrusted data is executed as active browser code in the security context of a website.
Simply explained
A website displays external input in such a way that the browser executes it as code. This allows malicious code to run on the page.
Why it matters in practice
The term contributes to secure, maintainable, and high-performance web applications as well as resilient technical decisions.
Example from business
A portal encodes user inputs contextually and adds a restrictive Content Security Policy.
Limits and pitfalls
- Input validation alone is not sufficient; output context, DOM sinks, templates, and third-party code determine the risk.
Origin & history
XSS was recognized as a central web vulnerability in the late 1990s; reflected, stored, and DOM-based are common forms.
Use in mid-sized companies
- Possible example: A portal encodes user inputs contextually and adds a restrictive Content Security Policy.
Frequently asked questions
What does Cross-Site Scripting (XSS) mean?
A vulnerability where untrusted data is executed as active browser code in the security context of a website. What should be considered? Input validation alone is not sufficient; output context, DOM sinks, templates, and third-party code determine the risk.
Sources
- XSS Prevention Cheat Sheet · OWASP, XSS Prevention Cheat Sheet
Source checked on 10.10.2026. Editorial application examples are hypothetical; no evidence of real customer results.
Editorially reviewed on: