---
title: Jericho's Cybersecurity Glossary | XSS (Cross-Site Scripting) Attacks
description: Cross-site scripting (XSS) is a type of web attack where attackers inject malicious scripts into websites, which are then executed by users’ browsers. These scripts can steal session cookies, redirect users to malicious sites, or deface websites.
---

[Jericho Security | Glossary](http://www.jerichosecurity.com/glossary)

# [Jericho's Cybersecurity Glossary | XSS (Cross-Site Scripting) Attacks](http://www.jerichosecurity.com/glossary/xss-attacks)

 Written by [Jericho Security Team](http://www.jerichosecurity.com/glossary/author/jericho-security-team) | September 28, 2024

#### *Definition:*

Cross-site scripting (XSS) is a type of web attack where attackers inject malicious scripts into websites, which are then executed by users’ browsers. These scripts can steal session cookies, redirect users to malicious sites, or deface websites.

#### *Use Cases:*

- Used by attackers to steal session cookies and impersonate users on legitimate websites.
- Employed in web-based phishing attacks where users are redirected to malicious sites or tricked into providing sensitive information.

#### *Related Terms:*

- [SQL Injection](https://www.jerichosecurity.com/glossary/sql-injection)
- [Session Hijacking](https://www.jerichosecurity.com/glossary/session-hijacking)
- Web Application Firewall (WAF)
- [Exploit](https://www.jerichosecurity.com/glossary/exploit)

#### *Questions and Answers:*

- **How does an XSS attack work?**Attackers inject malicious scripts into trusted websites. When users visit the compromised website, the malicious script runs in their browser, allowing attackers to steal data or hijack sessions.
- **What are the different types of XSS attacks?**The two main types are stored XSS (where the malicious script is stored on the server) and reflected XSS (where the script is reflected off a web server).
- **How can developers prevent XSS attacks?**Developers can prevent XSS by validating and sanitizing user input, using secure coding practices, and implementing security headers

[View full post](http://www.jerichosecurity.com/glossary/xss-attacks)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Jericho Security Team"
  },
  "dateModified" : "2024-09-29T15:15:04.969Z",
  "datePublished" : "2024-09-28T20:06:48Z",
  "headline" : "XSS (Cross-Site Scripting) Attacks",
  "image" : {
    "@type" : "ImageObject",
    "height" : 720,
    "url" : "https://40243630.fs1.hubspotusercontent-na1.net/hubfs/40243630/assets/images/jericho-featured-image.jpg",
    "width" : 1280
  },
  "mainEntityOfPage" : "http://www.jerichosecurity.com/glossary/xss-attacks",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Jericho Security | Glossary"
  }
}
```