What does XSS stand for?
XSS stands for Cross-site Scripting. A web attack where malicious script is injected into a page that other users view, letting the attacker steal session cookies or act as the victim inside the browser. The fix is for the site to validate input and encode output; users should keep browsers patched.
XSS is a web vulnerability in which an attacker gets a site to deliver the attacker's script to other users. The victim's browser runs the script as if it came from the site, so it can read session cookies, change what the page shows or send requests in the user's name. In stored XSS the script is saved on the site, for example in a comment. In reflected XSS it travels in a link the victim is persuaded to click. In DOM-based XSS the page's own script writes attacker-controlled data into the page. The fix is to encode user-supplied data on output and validate it on input.
XSS in practice: an example
A forum displays comments exactly as they were typed. An attacker posts a comment containing a script tag. Every visitor who opens the thread runs that script, which sends the visitor's session cookie to the attacker, who can then use the forum as that visitor.
What XSS is confused with
XSS vs CSRF: what is the difference?
XSS runs the attacker's script in the victim's browser. Cross-site request forgery runs no script on the site: it tricks the browser of a signed-in user into sending a request the user did not intend.
XSS vs SQL injection: what is the difference?
SQL injection sends attacker input to the database on the server. XSS sends attacker input to other users' browsers. Both come from trusting input, but the target differs.
Which exams cover XSS?
XSS is on the official CompTIA acronym list for one of the four exams covered here.
- A+ 220-1201 and 220-1202: 220-1202 2.0 (Security).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A comment field on a website lets visitors store text that later runs as script in other visitors' browsers. Which vulnerability is this?
- Stored XSS
- A buffer overflow
- Directory traversal
- A race condition
Show the answer
A. Stored XSS. Script that is saved on the site and served to every later visitor is stored cross-site scripting.
2. Which measure most directly prevents XSS?
- Encoding user-supplied data before it is written into a page
- Increasing the session timeout
- Using a longer domain name
- Disabling server backups
Show the answer
A. Encoding user-supplied data before it is written into a page. If special characters are encoded on output, the browser displays the input as text and does not execute it.
Sources: OWASP: Cross Site Scripting (XSS); MITRE CWE-79: Improper Neutralization of Input During Web Page Generation; NIST glossary: cross-site scripting. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.