Cross-Site Scripting (XSS) attacks are a form of threat that takes advantage of vulnerabilities in web applications to prey on user information. Using malicious scripts, attackers can reach different users through a usually trustworthy web page and access any information logged in the browser by the user including cookies and other sensitive information. These kinds of attacks can occur wherever a web program accepts user input without validation and subsequently uses it within its output.
It is important to take all necessary steps toward protecting your users, and this is especially true in the case of XSS attacks, as a user may only be aware of their use of your website, and not the malicious actor who is threatening them. This can then harm your website’s reputation as users will relate any issues to its users and may be disinclined to return.