Cross-Site Scripting
What is Cross-Site Scripting?
A web application vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, enabling data theft or session hijacking.
Frameworks that govern cross-site scripting
What the standards actually require on cross-site scripting
Requirements naming cross-site scripting across 6 standards, quoted from the control text.
Rank 1 in the 2024 CWE Top 25 (frequency x severity of CVEs). Cross-site Scripting (XSS): the software does not neutralise user-controllable input before it is placed in output used as a web page, allowing attacker-supplied script to execute in victims' browse...
CWE-79 · Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) →Address OWASP Top 10 A03 Injection per OWASP Top 10:2025. Injection occurs when untrusted data is sent to an interpreter as part of a command or query enabling SQL injection + NoSQL injection + LDAP injection + OS command injection + ORM injection + XML/XPath...
OWASPTOP10-3 · A03:2025 Injection Including Cross-Site Scripting →Use web template frameworks that escape user input automatically so that cross-site scripting is prevented by construction.
secure-by-design-a-guide-for-manufacturers-cisa::DT-4 · Web template frameworks (SSDF PW.5.1) →Application code scanners, which analyse source, binary or byte code for security flaws, malicious code and back doors, must be used whenever possible and particularly in development so flagged code is remediated before release, with mitigations such as IDS or...
disa-security-technical-implementation-guides-stigs::SRG-9 · SRG-9 ASD general requirements: code scanners whenever possible, application scanners regularly, mobile code by category →Applications, including web applications facing the internet, are tested against known attack types such as SQL injection, cross-site scripting and buffer overflow before implementation and after significant change.
ffiec-cybersecurity-assessment-tool-cat::D3.PC.Se.Int.2 · D3.PC.Se.Int.2 Secure Coding (Intermediate 2) →Intermediate control principles for secure development (required, with baseline, of an AI whose inherent risk is medium). Processes mitigate vulnerabilities found during secure development;
hkma-cyber-resilience-assessment-framework-c-raf::3.4.I · 3.4 Secure development: intermediate level →Questions people ask about cross-site scripting
What is Cross-Site Scripting?
Why is Cross-Site Scripting important for compliance?
Which compliance frameworks address Cross-Site Scripting?
Where can I learn more about Cross-Site Scripting?
See how Cross-Site Scripting applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.