Cross-site scripting occurs when a web application fails to properly validate or sanitize user input, allowing attackers to inject malicious client-side code into web pages viewed by other users.
Injecting an HTML tag such as an image element that loads content from a malicious site is a common XSS technique. When the page renders, the browser processes the injected code, which can execute attacker-controlled scripts or retrieve malicious resources.