Cross-site scripting (XSS) is a vulnerability in a website which allows malicious code to run on said website, typically a malicious Javascipt payload is executed giving the attacker full control over a user’s account or their presence on said website. Similar to an SQL injection except this malicious code is executed on the server.