Reflected XSS is a web vulnerability where attacker-controlled input is immediately returned by a server in a response, and the browser interprets it as executable script. The payload is not stored on the site; it is “reflected” in a page, often inside search fields, error messages, or URL parameters.
This matters because the script runs in the victim’s trusted browser context. An attacker can steal session tokens, read page content, perform actions as the user, or redirect the browser to other malicious content. In practice, reflected XSS often starts with a crafted link sent by email, chat, or another delivery channel. Defenses include strict output encoding, input handling, content security policies, and avoiding unsafe template rendering. For administrators and other privileged users, even a single clicked link can expose high-value accounts and management consoles.