+1 coinfor reading to the end
+1
Home / Glossary / XSS
Glossary · Security

XSS

Cross-site Scripting

In plain language

A website flaw that lets an attacker slip their own script into a page that other visitors then run.

The metaphor

Like someone pinning a forged notice on a shop's bulletin board that tells every reader to do what the fake says.

Going deeper

How it works

  • The site displays user input without cleaning it.
  • The attacker's script runs in the visitor's browser.
  • It can steal sessions or redirect to fake pages.
  • Developers fix it by cleaning input and output.
In practice
  • A web developer patches a comment form.
  • An online shop scans its site for the flaw.
  • A plugin update fixes a reported hole.

A question owners ask

Can a visitor protect themselves?

Mostly by keeping their browser updated. The fix belongs to the site owner.

Related terms
AAAAuthentication, Authorization, and AccountingAccount takeoverACLAccess Control ListAdmin accountAESAdvanced Encryption StandardAES-256Advanced Encryption Standards 256-bitAISAutomated Indicator SharingAPTAdvanced Persistent Threat

Something here sounds like your problem?

Every WILDCARD card exists to solve one named problem. Find yours.

Pick your problem →