Application security
An attack that smuggles a harmful script into a web page, so it runs in the browser of everyone who visits the page.
Formal
A flaw in a web application that places untrusted input into its pages without making it safe first; the web browser then runs that input as code with the same rights as the site's own code, so it can read what the user sees and act in their name.
In plain English
Like a notice board where someone pins up a note that, when read aloud, makes the reader hand over their house keys - the board itself never checks what is pinned to it.
In practice
An attacker posts a comment with a hidden script on a municipality's public consultation page; every resident who opens the page while logged in unknowingly hands the attacker their session.
Why it matters
The harmful code runs inside a site the visitor trusts, so the browser gives it the visitor's session and data; it remains one of the most often reported flaws in web applications.