XSS
In plain terms
An attack that injects malicious scripts into web pages other users view.
Going deeper
Cross-Site Scripting happens when an app renders untrusted input as executable script, letting attackers steal sessions or deface pages. It's prevented by escaping output and sanitizing input.
Under the hood
Types are stored, reflected, and DOM-based; defenses include output encoding, Content Security Policy, and frameworks that escape by default.
Examples
Injected <script> in a comment field, stealing cookies, defacing pages.
Think of it like...
Like graffiti that, once sprayed on a public wall, hypnotizes everyone who reads it into handing over their wallet.