A cross-site scripting attack occurs when data is inputted into a web application via an untrusted source like a web request. The data is then included in content forwarded to a user without being scanned for malicious content. This content is typically sent to their web browser in JavaScript but could also be in the form of Flash, HTML, and other code types that browsers can execute.