Cross-site scripting

XSS occurs when an application includes user-supplied content in a web page without properly encoding it. The browser then runs the attacker's script as if it came from the trusted site. There are three main types: stored XSS, where the script is saved on the server and served to every visitor; reflected XSS, where the script arrives in a crafted link; and DOM-based XSS, where client-side code mishandles data.

The impact depends on what the page can do. On an admin panel, XSS can lead to account takeover. On a checkout page, it can capture payment card details, a technique used in card-skimming attacks against online stores.

Prevention relies on output encoding, using modern frameworks that escape content by default, input validation and a strong Content Security Policy header. Keeping e-commerce platforms and plug-ins patched matters a great deal for small retailers. A web application penetration test will check for XSS along with other common flaws.