Cross-site scripting, usually shortened to XSS, has been a known category of vulnerability for well over two decades, and it's still one of the more common things I find in newly built apps, mostly because the feature it hides inside, showing text one user typed to other users, feels completely unremarkable while you're building it.
What's actually happening
Any feature that takes text from one user and displays it to another, a comment, a profile bio, a chat message, is potentially vulnerable if the app displays that text exactly as submitted, without treating it as plain text first. If a user submits something that looks like a snippet of code rather than ordinary words, and the app renders it directly onto the page for someone else to view, the browser can execute it as actual code rather than displaying it as harmless text.
Why this matters more than a broken comment box
Code running in another user's browser, under their own logged-in session, can do quite a lot: read anything visible on their screen, perform actions as if that user clicked them, or send their session information somewhere it shouldn't go. This isn't a display glitch, it's a way to act with another real user's own permissions, without ever needing their password.
Why it's so easy to build by accident
A comment feature that just takes whatever text was typed and shows it on the page works perfectly the first hundred times it's tested, because normal testing involves typing normal words. The gap only shows up the moment someone deliberately types something that looks like code instead of words, which a normal test pass has no reason to try.
How to check your own app
- Find any feature where one user's text gets shown to other users: comments, bios, messages, reviews.
- Submit a harmless test snippet that would visibly announce itself if it actually ran, rather than being shown as plain text.
- View that content as a different logged-in user, or in an incognito window, exactly the way another real user would see it.
- If the test snippet actually executes rather than displaying as plain text, that's the gap, confirmed directly.
The fix
User-submitted text needs to be treated strictly as text, not code, when it's displayed back to other users, which most modern frameworks do correctly by default, but not universally, and not automatically the moment a shortcut is taken to render something "as-is" for convenience. This is one of the oldest, best-understood vulnerabilities in web software, which makes it all the more worth actually checking for rather than assuming a modern framework has already handled it everywhere.