XSS payloads are crafted pieces of code injected into vulnerable websites to perform various malicious actions, such as stealing session cookies, redirecting users to phishing sites, or defacing web pages.