What Is a Cross-Site Scripting (XSS) Attack and Is Your Website at Risk?

What is a cross-site scripting attack and is your website at risk?

Cross-site scripting — XSS — is consistently one of the top three most common web application vulnerabilities. It has been used to steal login credentials from millions of users, hijack banking sessions, and redirect customers to fraudulent websites.

What XSS actually is

XSS happens when a website allows user input to be displayed on a page without checking or sanitising it first. An attacker submits malicious code — usually JavaScript — through a comment box, a search field, a contact form, or a URL parameter. The website stores or reflects that code and serves it back to other visitors as though it were part of the legitimate page.

When that malicious script runs in a visitor's browser, it does not look like an attack. The visitor sees your website. But behind the scenes, the script can be stealing their session cookies, logging their keystrokes, reading their form inputs, or redirecting them to a fake login page that captures their credentials.

The three types of XSS

Reflected XSS is the most common. The malicious script is embedded in a link. When a victim clicks the link, the script is reflected off your server and executes in their browser.

Stored XSS is more dangerous. The attacker submits the malicious script through a form and your site stores it in the database. Every visitor who views that page then executes the script without clicking anything.

DOM-based XSS occurs entirely in the browser and is harder to detect with server-side security tools.

What an attacker can do with XSS

Session hijacking allows an attacker to steal a user's session cookie and access their account without needing the password.

Credential harvesting redirects users to a fake login page that looks identical to yours. The user enters their credentials thinking they are logging into your site.

Malware distribution uses your site's trusted reputation to serve malicious downloads to your visitors.

Who is at risk

Any website that accepts and displays user input is potentially vulnerable — comment sections, review systems, search functionality, contact forms, and user profile pages.

How to find out if your site is vulnerable

Thorough testing requires automated tools that test dozens of XSS payloads across every input field and URL parameter on your site. Yrzo AI runs XSS scanning as one of its 44 automated security checks and reports exactly where vulnerabilities were found.

How XSS gets fixed

XSS is fixed by encoding output and implementing a Content Security Policy header that tells the browser which scripts are allowed to execute on your pages. Both fixes need to be implemented in the code by your developer.