What is cross-site scripting (XSS) and how to prevent it?
Summary: Cross-site scripting (XSS) is a web security vulnerability that lets an attacker manipulate a vulnerable site into returning malicious JavaScript, which executes in a victim's browser and circumvents the same origin policy. PortSwigger describes three main types - reflected, stored, and DOM-based - and notes that XSS is probably the most frequently occurring web security vulnerability, while real-world exploitation is probably less frequent than for other vulnerability classes.
What's compelling: An attacker who exploits XSS can masquerade as a victim user, carry out any action that user can perform, and access their data - and if that user has privileged access, the attacker may gain full control over all of the application's functionality and data.
Read the original at PortSwigger Research ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026