An attack technique where a programming flaw allows an attacker to execute script in the victims's browser which can hijack user sessions, deface websites, possibly introduce worms, etc