2.2: How to Prevent Cross Site Scripting Attacks. Cross Site Scripting vulnerabilities are the most common vulnerability found in WordPress plugins by a significant margin. In an analysis that we did of 1599 WordPress plugin vulnerabilities reported over a 14 month period, we found the following distribution:
https://www.wordfence.com/learn/how-to-prevent-cross-site-scripting-attacks/
Cross Site Scripting vulnerabilities are the most common vulnerability found in WordPress plugins by a significant margin. As you can tell from the above graphic, if you are able to fully understand and eliminate just the XSS vulnerabilities in your PHP code, you will be writing 47% less vulnerabilities.
https://www.wordfence.com/learn/how-to-prevent-cross-site-scripting-attacks/
In a Universal Cross-Site Scripting (UXSS, or Universal XSS) attack, vulnerabilities in the browser itself are exploited (rather than vulnerabilities in other websites, as is the case with XSS attacks); such attacks are commonly used by Anonymous, along with DDoS, to compromise control of a network.
https://en.wikipedia.org/wiki/Cross-site_scripting
Non-persistent XSS vulnerabilities in Google could allow malicious sites to attack Google users who visit them while logged in. The non-persistent (or reflected) cross-site scripting vulnerability is by far the most common type of web vulnerability.
https://en.wikipedia.org/wiki/Cross-site_scripting
What we’ve discussed above is a reflected XSS vulnerability. A reflected XSS attack is usually a link that contains malicious code. When someone clicks on that link, they are taken to a vulnerable website and that malicious code is ‘reflected’ back into their browser to perform some malicious action.
https://www.wordfence.com/learn/how-to-prevent-cross-site-scripting-attacks/
The attacker will send that link to a victim. The steps are as follows: 1  The victim clicks the link and visits the site. Let’s assume they’re already signed into the website with administrator level access.  The link and the XSS vulnerability cause the script to load from an external website into the target web page.
https://www.wordfence.com/learn/how-to-prevent-cross-site-scripting-attacks/
XSS attacks exploit the relationship between the user and the web site he or she is accessing. When you visit a web site, there is a presumption that the data transferred between your browser client and the web server is visible only to the owner of the web site and its authorized partners.
http://www.esecurityplanet.com/browser-security/how-to-prevent-cross-site-scripting-xss-attacks.html
You should be. But don't stop there, because chances are you're overlooking what is potentially the most prevalent website attack today: Namely, cross-site scripting (XSS). In one recent study, 75 percent of U.S. government websites were found to be vulnerable to XSS attack.
http://www.esecurityplanet.com/browser-security/how-to-prevent-cross-site-scripting-xss-attacks.html
Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy.
https://en.wikipedia.org/wiki/Cross-site_scripting
To achieve this, XSS attacks typically fall into two strategies: reflected attacks and persistent attacks. In a reflected cross-site scripting attack, the user unwittingly sends code to a web server which then reflects that code back to the user's browser, where it is executed and performs a malicious act. For example, consider a web site that accepts user input in the form of a search request.
http://www.esecurityplanet.com/browser-security/how-to-prevent-cross-site-scripting-xss-attacks.html
what is a reflective cross-site scripting attack?
A reflective cross-site scripting attack is a link that contains malicious code.