Reflected XSS, or reflected cross-site scripting, is a web vulnerability where attacker-controlled input is sent to a server and immediately returned in the response without proper escaping or validation. The browser then interprets that returned content as script, so malicious JavaScript runs in the victim’s session.
This matters because the attack usually needs only a crafted link or form submission, making it easy to deliver through phishing, redirects, or search results. Once executed, the script can read page content, change what the user sees, steal tokens that are exposed to JavaScript, or perform actions on behalf of the user. Defenders reduce the risk with output encoding, input validation, safe template handling, and security headers such as Content Security Policy. Reflected XSS often shows up in login pages, error messages, search fields, and redirect parameters, where user input is echoed back to the browser.