What is Cross-site scripting?

Also called XSS.

Cross-site scripting is when someone gets their own JavaScript to run on your pages, usually by submitting it somewhere your site later displays without escaping it. Their code then has the same access to your visitors as your own.

In more detail

The classic route is a comment, review or profile field rendered back into a page as HTML rather than as text. Modern frameworks escape output by default, so most real cases come from deliberately bypassing that — dangerouslySetInnerHTML and its equivalents — or from a third-party script you included.

Why it matters for your site

It is how session cookies get stolen and how payment forms get quietly modified. A Content-Security-Policy is the second line of defence: it does not stop the injection, it stops the injected script from running.