Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.
Stored and Reflected XSS Attacks:
XSS attacks can generally be categorized into two categories: stored and reflected. There is a third, a much less well-known type of XSS attack called DOM Based XSS which is not discussed here.
Stored XSS Attacks:
Stored attacks are those where the injected script is permanently stored on the target servers, such as in a database, in a message forum, visitor log, comment field, etc. The victim then retrieves the malicious script from the server when it requests the stored information. Stored XSS is also sometimes referred to as Persistent or Type-I XSS.
Reflected XSS Attacks:
Reflected attacks are those where the injected script is reflected off the web server, such as in an error message, search result, or any other response that includes some or all of the input sent to the server as part of the request. Reflected attacks are delivered to victims via another route, such as in an e-mail message, or on some other website. When a user is tricked into clicking on a malicious link, submitting a specially crafted form, or even just browsing to a malicious site, the injected code travels to the vulnerable web site, which reflects the attack back to the user’s browser. The browser then executes the code because it came from a “trusted” server. Reflected XSS is also sometimes referred to as Non-Persistent or Type-II XSS.
How to Determine If You Are Vulnerable:
XSS flaws can be difficult to identify and remove from a web application. The best way to find flaws is to perform a security review of the code and search for all places where input from an HTTP request could possibly make its way into the HTML output. Note that a variety of different HTML tags can be used to transmit a malicious JavaScript. Nessus, Nikto, and some other available tools can help scan a website for these flaws, but can only scratch the surface. If one part of a website is vulnerable, there is a high likelihood that there are other problems as well.
How to Protect Yourself:
If your website is based on WordPress then you can easily stop the Cross-site Scripting (XSS) by using Prevent XSS Vulnerability Plugin. You can read the details about the Prevent XSS Vulnerability Plugin from here: https://www.yasglobal.com/web-design-development/wordpress/prevent-xss-vulnerability/
To download, please visit wordpress.org and search the plugin by the name of Prevent XSS Vulnerability or directly visit the plugin page from here: https://wordpress.org/plugins/prevent-xss-vulnerability/
More about Cross-site Scripting:
To know more about Cross-site Scripting (XSS), Please refer to this page: https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)