Category hub: Web application security

In one sentence: Cross-site scripting is a website flaw that lets an attacker make your visitors’ browsers run the attacker’s code as if it came from your site.

What is cross-site scripting (XSS)?

OWASP explains that cross-site scripting (XSS) happens when data enters a web application from an untrusted source, most often a web request, and is included in a page sent to a user without being checked or made safe. The harmful content is often JavaScript. The browser cannot tell the script is untrusted, so it runs it.

OWASP notes the name is a misnomer, as the term now covers injection of almost any content.

How it works

OWASP describes three main types:

• Reflected: the harmful input is bounced straight back, for example in a search result or an error message, and a victim is tricked into following a crafted link.
• Stored: the script is saved on the server, for example in a comment or forum post, and runs for every visitor who views it.
• DOM-based: the page’s own browser-side code handles input unsafely, so the harm happens in the browser.

Steps in a typical attack:

1. The attacker finds a field or link whose content appears on a page without being made safe.
2. They craft input containing a script and get a victim to load it.
3. The script runs in the victim’s browser with that user’s access to the site.
4. OWASP says the script can access cookies and session tokens, rewrite the page, or redirect the user.

Who it affects and how badly

Any site that shows user-supplied content can be affected. Impact depends on the app and the user. OWASP says XSS can lead to account impersonation, stealing sensitive data and more.

• Sole trader to 250 staff (small online shops, SaaS start-ups, recruitment portals, charities with donor portals): an admin who views a stored script can lose their session, giving the attacker control of the application and its data.
• 250 plus and regulated firms (fintech, healthcare portals): a compromised user session can expose personal data and lead to ICO reporting.

Real examples

CISA’s Known Exploited Vulnerabilities catalogue records exploitation of XSS flaws in widely used products. For example, in May 2026 CISA added CVE-2026-42897, a Microsoft Exchange Server cross-site scripting vulnerability, based on evidence of active exploitation: CISA alert.

How to detect it

• A manual test is the reliable method, because OWASP notes filters can miss other character encodings.
• Review web server and application logs for requests containing script tags or odd characters in parameters.
• Watch for users reporting unexpected redirects or logouts.

How to fix or prevent it

1. Use a modern web framework that escapes output automatically, and avoid its “escape hatches” that write raw HTML. OWASP says frameworks reduce XSS but can be used insecurely.
2. Apply context-sensitive output encoding wherever user data is shown. OWASP calls this easier and stronger than input filtering alone.
3. Use HTML sanitisation for any rich text you must accept.
4. Add a Content Security Policy header to limit what scripts can run.
5. Use cookie attributes to limit the damage. OWASP says they do not fix the root cause.
6. Keep plugins patched. OWASP says a web application firewall adds a layer but cannot reliably prevent all XSS.

Related terms

• owasp-top-10
• sql-injection
• content-security-policy
• output-encoding
• input-validation
• session-hijacking
• How XSS works

Also read: access-bypass.

Frequently asked questions

What is cross-site scripting?
It is a website flaw that lets an attacker make your visitors’ browsers run the attacker’s code as if it came from your site.

What are the types of XSS?
OWASP describes three main types: reflected, stored and DOM-based.

How do I prevent XSS?
Use a framework that escapes output, apply context-sensitive output encoding, sanitise rich text, add a Content Security Policy header and keep plugins patched.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.

Service page: Wolfcore web application penetration testing.