Cross-site scripting (XSS) is a security vulnerability that allows attackers to inject malicious client-side scripts into web pages viewed by other users. It exploits the trust a browser has for the vulnerable site. The injected scripts execute in the context of the victim's session, potentially stealing cookies or session tokens.