A security vulnerability where malicious scripts are injected into web pages viewed by other users. Prevented by output encoding and Content Security Policies. (Ch. 27)