Cross-site scripting (XSS) is a web application vulnerability where an attacker injects malicious client-side script (typically JavaScript) into content served to other users, which then executes in their browsers — enabling session hijacking, credential theft, or defacement. This matches the statement exactly: it is indeed a vulnerability that allows code injection by malicious users, so 'True' is correct. 'False' would be wrong because XSS is one of the most well-documented and common web injection vulnerabilities (historically a perennial OWASP Top 10 entry).