XSS stands for Cross-Site Scripting and means that an application sends custom data to the web browser without validating it as coming from the web site. This gives hackers the ability to "kidnap" customers or deface your website.