Cross-Site Scripting (XSS) is a type of security vulnerability found in web applications. It allows attackers to inject malicious scripts into web pages viewed by other users. When a user visits a compromised page, the harmful script runs in their browser, potentially stealing sensitive information like cookies or login credentials. There are different types of XSS attacks, including Stored XSS, where the malicious script is saved on the server, and Reflected XSS, where the script is sent as part of a URL. Protecting against XSS involves validating and sanitizing user input to ensure that harmful scripts cannot be executed.