XSS or Cross-site Scripting attacks take place by injecting malicious code into a users' browser. On the other hand, CSRF (Cross-site Request Forgery) is a kind of attack where an attacker exploits user credentials to perform certain actions on their behalf.