Cross-site scripting (XSS) is a security vulnerability in web applications where malicious code is injected into a web page viewed by other users. There are two types: stored and reflected. Stored XSS involves the attacker injecting malicious code into a vulnerable web page stored on the server. Reflected XSS involves injecting malicious code into a web page through a user input. To prevent XSS, user input should be properly validated and displayed data should be encoded. Content Security Policy (CSP) can also be used to specify allowed sources of data and scripts.