Cross-site scripting
Also known as XSS
Injecting script into a web page that then executes in another user's browser in the context of that site.
Because the script runs as the site, it can read session tokens, alter what the page displays, and act as the victim. Stored variants persist for every visitor; reflected ones require a crafted link.
The fix is contextual output encoding and a content security policy, not input filtering alone, which attackers reliably find ways around.
Where this comes up
Cross-site scripting sits inside our penetration testing work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.