Web Vulnerabilities
Cross-Site Scripting
Also: XSS, CWE-79
A flaw where a web page includes untrusted input in a way that lets a visitor's browser run it as script.
In more detail
The browser runs any script that arrives in a page from your site, with your site's access to cookies and the logged-in session. If a comment, name or message is inserted into HTML without encoding, a visitor's browser may treat it as code. It is fixed by encoding output for the place it lands, and limited by a Content Security Policy.