What is cross-site scripting XSS?

Cross-site scripting occurs when untrusted data is interpreted by a browser as executable script or active markup in another user context. The main defense is context-appropriate output encoding, with framework escaping and CSP providing additional layers.