XSS doesn't involve someone compromising an online store's systems or adding code to pages through normal administrative functions. XSS mainly takes two forms:

XSS doesn't involve someone compromising an online store's systems or adding code to pages through normal administrative functions. XSS mainly takes two forms: Non-persisted / reflected is the most common: An example of this: A webpage has a vulnerable URL parameter that doesn't sanitize the data. ex: http://example.com/?username=<data> http://example.com/?username=<data> Instead of removing HTML/etc from that username parameter, it just writes it to the page, so I can then send you a malicious link for a site that you're familiar with and get the code to execute in your browser. Stored/Persistent: Example: a social media site. If it didn't properly sanitize your posts, you could store malicious code as part of one of your posts and then anyone who saw that post would execute your code. Now, if you were clever, you would then make a post using their account and have it propagate your XSS and now you've created an XSS worm.