Skip to content

Cross-Site Scripting

What is Cross-Site Scripting?

A web application vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, enabling data theft or session hijacking.

Information Security

Frameworks that govern cross-site scripting

NIST Cybersecurity Framework 2.0View framework →CIS Controls v8View framework →

What the standards actually require on cross-site scripting

Requirements naming cross-site scripting across 3 standards, quoted from the control text.

CWE Top 25 Most Dangerous Software Weaknesses (2024)1 control

Rank 1 in the 2024 CWE Top 25 (frequency x severity of CVEs). Cross-site Scripting (XSS): the software does not neutralise user-controllable input before it is placed in output used as a web page, allowing attacker-supplied script to execute in victims' browse...

CWE-79 · Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) →
OWASP Top 10:20251 control

Address OWASP Top 10 A03 Injection per OWASP Top 10:2025. Injection occurs when untrusted data is sent to an interpreter as part of a command or query enabling SQL injection + NoSQL injection + LDAP injection + OS command injection + ORM injection + XML/XPath...

OWASPTOP10-3 · A03:2025 Injection Including Cross-Site Scripting →
Secure by Design: A Guide for Manufacturers (CISA)1 control

Use web template frameworks that automatically escape output by default. Eliminate cross-site scripting (XSS) as a class of vulnerability.

SBD-DEV-03 · Web Template Frameworks with Auto-Escaping →

Questions people ask about cross-site scripting

What is Cross-Site Scripting?
A web application vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, enabling data theft or session hijacking.
Why is Cross-Site Scripting important for compliance?
Cross-Site Scripting is a key concept in Information Security. Understanding cross-site scripting helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
Which compliance frameworks address Cross-Site Scripting?
Cross-Site Scripting appears in the requirement text of CWE Top 25 Most Dangerous Software Weaknesses (2024), OWASP Top 10:2025, Secure by Design: A Guide for Manufacturers (CISA). Across these standards we have identified 3 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Cross-Site Scripting?
Explore our compliance framework pages to see how cross-site scripting applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Cross-Site Scripting applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.