In a cross-site scripting attack, a vulnerable web application returns an unexpected response based on unsanitized user input. As a result, attackers can use the app to execute malicious scripts on the target's computer.