{
  "slug": "cross-site-scripting",
  "url": "https://www.infinity8labs.com/vulnerabilities/cross-site-scripting/",
  "title": "Cross-site scripting (XSS)",
  "short": "XSS",
  "aliases": [
    "Reflected XSS",
    "Stored XSS",
    "DOM-based XSS"
  ],
  "summary": "Untrusted data is written into a web page without the right encoding, so an attacker's script runs in another user's browser with that user's session and permissions.",
  "cwe": [
    "CWE-79"
  ],
  "owasp": "A03:2021 Injection",
  "typical_severity": {
    "min": "medium",
    "max": "high"
  },
  "updated": "2026-10-14",
  "references": [
    {
      "title": "CWE-79: Improper Neutralization of Input During Web Page Generation",
      "url": "https://cwe.mitre.org/data/definitions/79.html"
    },
    {
      "title": "OWASP Cross Site Scripting Prevention Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html"
    },
    {
      "title": "OWASP DOM based XSS Prevention Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html"
    },
    {
      "title": "OWASP Web Security Testing Guide: Testing for Cross Site Scripting",
      "url": "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/01-Testing_for_Reflected_Cross_Site_Scripting"
    },
    {
      "title": "MDN: Content Security Policy (CSP)",
      "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"
    },
    {
      "title": "MITRE ATT&CK T1189: Drive-by Compromise",
      "url": "https://attack.mitre.org/techniques/T1189/"
    }
  ],
  "sections": [
    "https://www.infinity8labs.com/vulnerabilities/cross-site-scripting/#overview",
    "https://www.infinity8labs.com/vulnerabilities/cross-site-scripting/#impact",
    "https://www.infinity8labs.com/vulnerabilities/cross-site-scripting/#examples",
    "https://www.infinity8labs.com/vulnerabilities/cross-site-scripting/#remediation",
    "https://www.infinity8labs.com/vulnerabilities/cross-site-scripting/#testing",
    "https://www.infinity8labs.com/vulnerabilities/cross-site-scripting/#references"
  ],
  "related_advisories": [
    "https://www.infinity8labs.com/advisories/I8L-2026-0001/"
  ]
}