Security

VS Code extension authors often assume XSS is “just a web app problem.” That’s a mistake. If your extension uses a webview, custom editor, notebook renderer, or any HTML UI at all, you’re building a mini browser surface inside an editor that developers trust deeply. That trust changes the impact. A sloppy XSS bug in a marketing site is bad. A sloppy XSS bug in a VS Code extension can expose workspace data, abuse extension APIs indirectly, phish secrets, or trick users into running commands. ...

Discord bots themselves do not execute browser JavaScript inside Discord messages, and that lulls a lot of developers into the wrong threat model. I’ve seen this play out the same way over and over: someone builds a bot, then adds a web dashboard, moderation panel, transcript viewer, ticket system, or message log page. The bot becomes the source of untrusted content, and the browser-facing parts become the XSS sink. That distinction matters. The bug usually is not “Discord has XSS.” The bug is “my bot collected hostile input from Discord and I rendered it into HTML like an idiot.” ...

Cross-site scripting in WordPress plugins usually comes down to one boring truth: untrusted data reached HTML, JavaScript, or an attribute without the right escaping. I’ve reviewed a lot of plugin code over the years, and the same patterns keep showing up: $_GET echoed into admin pages option values printed without escaping post meta dropped into attributes localized script data built unsafely AJAX handlers returning HTML stitched together from user input WordPress gives you the tools to avoid this. The hard part is using the right function for the right output context. ...

WordPress theme code is where a lot of XSS bugs quietly survive for years. I’ve seen the same pattern over and over: the plugin gets blamed, the CMS gets blamed, but the actual issue lives in a theme template that prints user-controlled data with zero escaping. Theme developers often focus on layout, custom fields, menus, search forms, AJAX helpers, and admin options. Security ends up as an afterthought. The awkward part is that WordPress already gives you solid escaping and sanitization APIs. Most theme XSS bugs happen because developers either skip them or use the wrong one in the wrong context. ...

Cross-site scripting in PHP usually happens because someone escaped the wrong thing, in the wrong place, at the wrong time. I’ve seen teams add htmlspecialchars() everywhere and still ship XSS. Not because the function is bad, but because XSS prevention is context-sensitive. A value that is safe in HTML text is not automatically safe in an attribute, a JavaScript string, or a URL. If you remember one rule, make it this one: ...

Cross-site scripting is one of those vulnerabilities that never really goes away. We get better frameworks, safer templating, stricter defaults, and still XSS shows up in bug bounty reports every day. The reason is simple: if an attacker can get the browser to execute JavaScript you didn’t intend to run, they can often act as the user, steal data, or pivot deeper into your app. Content Security Policy, or CSP, is one of the few browser features that can meaningfully reduce the blast radius of XSS. It is not a silver bullet. It will not magically fix unsafe HTML rendering. But a good CSP can turn “one bad escaping bug equals account takeover” into “the payload just doesn’t run.” ...

Cross-site scripting prevention gets a lot harder than it should because people hear “sanitize input” and stop there. That’s not enough. If you remember one thing from this tutorial, make it this: XSS is prevented at output time, based on the exact context where data is rendered. Output encoding is the boring, reliable workhorse of XSS defense. It’s not flashy, but it’s the thing that stops untrusted data from turning into executable HTML, JavaScript, or CSS in the browser. ...

Cross-site scripting is one of those vulnerabilities that keeps showing up because it’s fundamentally simple: untrusted data ends up in a place where the browser treats it as code. But “XSS” isn’t just one thing. In practice, you’ll usually hear about three flavors: Reflected XSS Stored XSS DOM-based XSS They all end with attacker-controlled JavaScript running in a victim’s browser, but the way the payload gets there matters a lot for both exploitation and prevention. ...

Cross-site scripting, usually shortened to XSS, is one of those web security bugs that sounds old-school but still shows up everywhere. If you build web apps that display user-controlled content, you need to understand it. Not just the definition, but how it actually happens in real code. The short version: XSS happens when an attacker gets your site to treat untrusted input as executable code in the browser. Usually that means JavaScript, but the real issue is broader than “someone injected a script tag.” The browser is parsing HTML, attributes, URLs, CSS, and script contexts differently, and if you put user data into the wrong place without the right protection, the attacker can make the page do things you never intended. ...

Cross-site scripting in React and Next.js is one of those topics that sounds simpler than it really is. A lot of developers hear “React escapes output by default” and mentally file XSS away as mostly solved. That’s true right up until you touch dangerouslySetInnerHTML, render CMS content, build a markdown feature, pass untrusted values into URLs, or mix server and client rendering in ways that make assumptions drift. The good news: React and Next.js give you a strong baseline. The bad news: they do not make you XSS-proof automatically. ...