XSS (Cross-Site Scripting) is a vulnerability where an attacker injects malicious JavaScript that runs in another user’s browser, because the app renders user-controlled content without escaping it. The script then runs with that user’s privileges — stealing cookies, keystrokes, or session tokens.
Worked example: a comment field that stores and re-displays raw HTML lets an attacker post a script tag; every visitor who views the comment runs the attacker’s code, which can exfiltrate their session cookie. Gotcha: the fix is context-aware output ENCODING (escape HTML when rendering into HTML, JS when into script) plus a Content-Security-Policy as defense-in-depth — modern frameworks escape by default, but “dangerously set inner HTML” escapes and inline event handlers reopen the hole.