Cross-site Scripting (XSS)

PCIComplianceHubLast updated 27 September 2026

A type of web application vulnerability where an attacker injects malicious scripts into trusted websites, causing them to be executed by a victim's browser and potentially leading to data theft or unauthorized actions.

In PCI DSS v4.0.1. 6.2.4

Related. XSS (Cross-Site Scripting), Injection Attack, Secure Coding, E-Skimming, Content Security Policy (CSP)

Sources. PCI DSS v4.0.1 (June 2024)