What is XSS?
Injecting scripts into a page other users load.
Cross-Site Scripting — when untrusted input ends up rendered as HTML/JavaScript, an attacker's script runs in victims' browsers and can steal sessions or act as them. Defense: escape output by default, sanitize rich input, and use a Content-Security-Policy.