Cross-site Scripting (XSS)
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting happens when an application places attacker-controlled data into a page without encoding it for the context it lands in, so the browser treats that data as markup or script. The injected script runs with the full privileges of the vulnerable site in the victim's browser, which means it can read the page, act as the user, and steal anything the page can reach. The three classic forms are reflected (the payload comes back in the immediate response), stored (the payload is saved and served to other users), and DOM-based (client-side JavaScript moves untrusted data into a dangerous sink without the server ever seeing it).
Ranks change between editions as the underlying CVE data changes, so exam questions rarely hinge on an exact rank. Know what each weakness is, how it is exploited, and how it is prevented.
How it shows up in the real world
- A search page echoes the query string into the results heading unencoded, so a crafted link runs script in the browser of anyone who clicks it.
- A comment field stores a script tag that executes for every visitor who views the thread, including administrators.
- Front-end code reads location.hash and writes it into the page with innerHTML, creating DOM-based XSS that never touches the server.
How to mitigate it
- Encode output for the exact context it is written into (HTML body, attribute, JavaScript, URL), ideally through a templating engine that escapes by default.
- Avoid dangerous sinks such as innerHTML, document.write and eval; use textContent and safe DOM APIs, and sanitize with a vetted library when rich HTML is genuinely required.
- Deploy a strict Content Security Policy with nonces or hashes so injected inline script is refused even when encoding is missed.
- Set session cookies HttpOnly and SameSite to limit what a successful injection can steal.
Go deeper
Practice this topic
Test your knowledge of Cross-site Scripting (XSS) with exam-style practice questions.