---
title: Cross-site scripting (XSS)
canonical: https://wpsecurityninja.com/dictionary/xss/
---
# Cross-site scripting (XSS)

Cross-site scripting (XSS) injects malicious JavaScript into pages that other users’ browsers will run.

Last updated: 2026-08-26

Also called: XSS, cross-site scripting, cross site scripting

## Related terms

- [CSRF](https://wpsecurityninja.com/dictionary/csrf/): CSRF tricks a logged-in browser into sending a request the user did not mean to send.
- [Session hijacking](https://wpsecurityninja.com/dictionary/session-hijacking/): Session hijacking steals or guesses a valid session so the attacker acts as the logged-in user.
- [Vulnerability](https://wpsecurityninja.com/dictionary/vulnerability/): A vulnerability is a weakness in software that attackers can abuse to break confidentiality, integrity, or availability.
- [WordPress nonce](https://wpsecurityninja.com/dictionary/wordpress-nonce/): A WordPress nonce is a short-lived token used to verify that a request was intentional, mainly to reduce CSRF risk.

[Full guide](https://wpsecurityninja.com/understanding-and-preventing-wordpress-xss-attacks/)

## Why it matters for WordPress

Stored XSS in a comment, page builder field, or admin notice can run in another user’s browser. For admins, that can mean stolen cookies, forced actions, or malware shown to visitors. Reflected XSS often rides on crafted URLs in plugins.

## How it shows up in practice

- Unexpected popups, redirects, or injected ads on the front end
- Admin screens that behave oddly after viewing crafted content
- Scanner or CVE notes mentioning reflected or stored XSS in a plugin

## What to do

1. Update vulnerable plugins and themes quickly.
2. Limit who can publish unfiltered HTML.
3. Sanitize and escape output in custom themes and plugins.
4. Use a content security policy where practical (hosting or edge).
5. Treat odd JavaScript on your pages as an incident: scan, review recent content, check users.

Full guide: [WordPress XSS attacks](https://wpsecurityninja.com/understanding-and-preventing-wordpress-xss-attacks/).