Cross-site Scripting
Cross-site scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
“A vulnerability that allows attackers to inject malicious code into an otherwise benign website.”
(Definition reproduced from the ISTQB Glossary. Copyright belongs to ISTQB.)
View the complete ISTQB GlossaryWhat is Cross-site Scripting?
XSS occurs when applications fail to properly validate or encode user input, allowing malicious JavaScript to execute in another user's browser.
Attack mechanism: Malicious scripts execute within a trusted website.
Common types: Stored, reflected, and DOM-based XSS are the most common variants.
Testing focus: Security testing verifies that user input cannot execute unauthorized scripts.
Real World Example
A regulated product team is preparing a release where Cross-site scripting appears in reviews, test design conversations, or defect triage rather than as an isolated glossary word.
The risk is that the team treats Cross-site scripting as interchangeable with nearby ISTQB terms. That makes test scope blurry and can lead to weak evidence for the release decision.
The tester anchors the discussion in the official definition, asks where the concept appears in the product, and designs examples that show the difference between Cross-site scripting and similar ideas.
The page becomes useful in practice because Cross-site scripting is connected to a specific testing decision, not memorized as a detached definition.
Practice Questions
Question 1
Which statement BEST describes Cross-site scripting in the context of ISTQB terminology?
Question 2
A tester needs to explain Cross-site scripting to a non‑technical stakeholder. Which approach is MOST appropriate?
Test your knowledge with real ISTQB-style questions
You’ve learned Cross-site Scripting. Test your understanding with topic-specific questions in our Mock Exams.