Untrusted data enters a web application, typically from a web request.
The web application dynamically generates a web page that contains this untrusted data.
During page generation, the application does not prevent the data from containing content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes, mouse events, Flash, ActiveX, etc.
A victim visits the generated web page through a web browser, which contains malicious script that was injected using the untrusted data.