What is a cross-site scripting attack and is your website at risk?
Cross-site scripting — XSS — is consistently one of the top three most common web application vulnerabilities. It has been used to steal login credentials from millions of users, hijack banking sessions, and redirect customers to fraudulent websites.
What XSS actually is
XSS happens when a website allows user input to be displayed on a page without checking or sanitising it first. An attacker submits malicious JavaScript through a comment box, search field, or contact form. The website serves it back to other visitors as though it were part of the legitimate page.
When that script runs in a visitor's browser, it can steal session cookies, log keystrokes, read form inputs, or redirect visitors to a fake login page.
The three types of XSS
Reflected XSS — malicious script embedded in a link. When a victim clicks the link, the script executes in their browser.
Stored XSS — attacker submits malicious script through a form and your site stores it in the database. Every visitor who views that page executes the script.
DOM-based XSS — occurs entirely in the browser, harder to detect with server-side tools.
Who is at risk
Any website that accepts and displays user input — comment sections, review systems, search functionality, contact forms, user profile pages.
How XSS gets fixed
XSS is fixed by encoding output and implementing a Content Security Policy header. Both fixes need to be implemented in the code by your developer.
Yrzo AI runs XSS scanning as one of its 75+ automated security checks. Starting at £149.
Find out if your website has these vulnerabilities
Yrzo AI runs 44 automated security checks and delivers a full report in under 20 minutes. Starting from £149.
Scan your website →