Cross-site scripting

Cross-site scripting (XSS) is a client-side code injection attack. The attacker aims to execute malicious scripts in a web browser of the victim by including malicious code. 
How it works.
In a Cross-site Scripting attack (XSS), the attacker uses your vulnerable web page to deliver malicious JavaScript to your user. The user's browser executes this malicious JavaScript on the user's Computer. Note that about one in three websites is vulnerable to Cross-site scripting.
Types.
Non-persistent.
Non-persistent XSS vulnerabilities in Google could allow sites to attack Google users who visit them while logged in.
Persistent.
The persistent XSS vulnerability is a more devastating variant of a cross-site scripting flaw: it occurs when the data provided by the attacker is saved by the server, and then permanently displayed on "normal" pages returned to other users in the course of regular browsing, without proper HTML escaping.
Self-XSS.
Self-XSS is a form of XSS vulnerability which relies on social engineering in order to trick the victim into executing malicious JavaScript code into their browser.
Mutated XSS.
Mutated XSS happens when the attacker injects something that is seemingly safe, but rewritten and modified by the browser, while parsing the markup. This makes it extremely hard to detect or sanitize within the websites application logic.