A vulnerability that allows attackers to inject malicious code into an otherwise benign website.