Cross-Site Scripting (XSS) occurs when untrusted input is incorporated into a web page without proper validation or output encoding. This allows an adversary to inject malicious JavaScript into the page. When other users load the compromised page, the attacker’s script executes in their browser, enabling session hijacking, credential theft, or arbitrary actions on behalf of the victim.

Remediation

• Use modern frontend frameworks (e.g., React, Angular, Vue) that automatically apply context-aware escaping for untrusted data.
• Apply strict, context-sensitive output encoding for any data rendered into HTML, attributes, JavaScript, or CSS.
• Enforce Content Security Policy (CSP) to reduce the impact of potential XSS by restricting inline scripts and untrusted sources.
• Validate and sanitise input to minimise attack surface, especially in legacy code where auto-escaping is not available.