CyberGuard dictionary / Web Application Security
Cross-Site Scripting
Also known as XSS
Injection of malicious script into content that another user’s browser executes.
In simple terms
An attacker places code where a website should show ordinary text.
Technical explanation
Stored, reflected, and DOM-based XSS differ in how attacker-controlled content reaches an executable browser context.
Browser execution occurs when untrusted content is inserted into HTML, script, or another active context without suitable encoding or safe APIs. The right defense depends on that output context.
Examples in practice
A comment field stores script that runs when another visitor reads the page.
A forum renders a user's comment as plain text, so an attempted script appears as characters instead of running. The team also reviews client-side code that inserts comments into the page.
Why it matters
Output encoding and safe rendering help protect sessions and user actions.
VERIFY & LEARN MORE
Sources and further reading
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.