XSS lets attackers steal cookies, hijack sessions, or deface pages. Prevention: escape all user input on output, use Content Security Policy headers, prefer templating engines with auto-escaping. Every CMS should escape by default and require explicit opt-in for raw HTML.
XSS
Also known as: cross-site scripting