Cross-Site Scripting (XSS) consists of getting malicious JavaScript executed in another user's browser by exploiting unescaped content displayed on a page. It allows stealing sessions or acting on the victim's behalf. You protect against it with escaping and a CSP policy.
Example
A comment containing <script>…</script> displayed as is in the page.