Cross-site scripting

How it is used

Abbreviated XSS, not CSS, which is the styling language. Types include stored, reflected and DOM-based XSS. Output encoding and a Content Security Policy (CSP) are the standard defences, and reports often rate stored XSS higher than reflected XSS.

Example sentences

1. The comment field had a stored cross-site scripting flaw.

2. Encoding the output fixed the cross-site scripting issue on the profile page.

Common collocations

• stored XSS
• reflected XSS
• DOM-based XSS
• output encoding
• Content Security Policy

Related terms

• SQL injectionA vulnerability in which input sent to an application is treated as part of a database query, so that an attacker can read or change data they should not reach.
• web application firewallA firewall that sits in front of web applications and filters HTTP traffic to block common web attacks such as SQL injection and cross-site scripting.
• vulnerabilityA weakness in software, hardware, a configuration or a process that an attacker could use to cause harm or to gain access they should not have.
• findingA security problem or weakness that is identified and documented during an audit, assessment or penetration test, usually with a severity rating.

This word in other fields

The same English word can have a different meaning in another field:

• cross-site scripting · Software Engineering
• cross-site scripting · Web Development

More terms: Threats and Attacks

• threat
• phishing
• exploit
• compromise
• social engineering
• DDoS
• attack surface
• brute-force attack
• privilege escalation
• lateral movement
• man-in-the-middle attack
• threat actor