Why It Matters
XSS is consistently ranked among the most common web security vulnerabilities, and it can affect any website that displays user-generated content without properly sanitising it. Comment sections, search boxes, contact forms, and review pages are all potential entry points. If your website is vulnerable, an attacker could steal your customers’ session data and impersonate them, harvest personal information entered into forms, or damage your brand by altering what visitors see. Fixing XSS vulnerabilities is a fundamental part of web development, and any competent development team should be testing for them routinely.
Example
Your website has a search feature that displays “You searched for: [search term]” on the results page. An attacker crafts a special link containing malicious code in the search parameter and shares it in an email. When someone clicks the link, the search page renders the malicious code as part of the page. That code silently sends the visitor’s session cookie to the attacker, who can then log in as that visitor. Proper input sanitisation would have stripped the malicious code before displaying it. XSS sits in our glossary alongside SQL injection and the broader idea of a vulnerability.
