Padding
Extra bytes added to a plaintext so that it fills a whole number of blocks.
ECB and CBC need the plaintext to be an exact multiple of the block size, 16 bytes for AES. Whatever is missing gets filled according to an agreed rule. PKCS#7 is the most common: each padding byte holds the number of padding bytes, so the receiver knows how much to strip. CTR and other stream modes need no padding at all, which is one of their few undisputed virtues.
Trouble starts at removal. If the receiver reveals whether the padding was valid, through an error message or a timing difference, an attacker gets an oracle to query. That is the basis of the padding oracle attack that Serge Vaudenay described in 2002, and of a whole family of follow-ups.