Cross-site scripting (XSS): what it is and why it matters

Cross-site scripting is a vulnerability where an attacker manages to get their own code to run in the browsers of your site's visitors.

It occurs when a site displays user-supplied content without properly sanitising it — a comment, a search term, a profile field. If the site echoes that content back into a page unchecked, an attacker can slip in a script that then runs for everyone who views it. The consequences include:

• Hijacking visitors' logged-in sessions.
• Stealing information entered on the page.
• Defacing content or redirecting users to malicious sites.

XSS is dangerous because it turns your own trusted site into the delivery mechanism against your users. A penetration test probes the places where user input is reflected or stored to find these holes, and the report explains where they are and how to fix them.