XSS Cross-Site Scripting
When an attacker sneaks JavaScript code into a site so other users end up running it.
Classic: a comments field that allows someone to write <script>steal-cookies()</script>. When the next visitor loads the page, the code runs in their browser — session cookies stolen, forms sniffed, etc.
Fix: always escape user input before displaying it (< becomes < so it renders as text, not a tag). Modern frameworks do this automatically; plain old PHP doesn't.