It is a software vulnerability that allows attackers to inject malicious code in websites otherwise benign, compromising the confidentiality and the integrity of data transfers. It also enables unauthorized parties to cause client-side scripts to be executed by other users. This vulnerability can be employed to overwrite access controls and transform the issue into a security risk.