XSS (cross-site scripting) exploits misguided implementations of a common web application feature: the ability to receive HTML from one user and present it to others. Because unfiltered HTML can contain JavaScript, an attacker can receive it, then run code on behalf of another user (or users) when the other user returns to the web application.