An XSS vulnerability allows an attacker to modify a web page however they see fit, sometimes by injecting javascript, flash objects, HTML or anything else the browser can render. The attack targets your application s users and not the application itself, but it uses your application as the vehicle for the attack. The most common attack performed with cross-site scripting involves the disclosure of information stored in user cookies or on the page itself. There are a number of common mistakes organizations make that leave their applications vulnerable to attack.
Source: https://threatpost.com/how-secure-web-apps-against-xss-flaws-090711/75618/