A web security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially stealing session data or credentials.