Cross-site scripting (XSS) is a type of security vulnerability found in web applications. It allows attackers to inject malicious scripts into web pages viewed by other users. When a user visits an affected page, the script runs in their browser, potentially stealing sensitive information like cookies or session tokens. There are different types of XSS, including reflected XSS, where the malicious script is reflected off a web server, and stored XSS, where the script is permanently stored on the server. Protecting against XSS involves validating and sanitizing user input to ensure that harmful scripts cannot be executed.