An XSS worm, sometimes referred to as a cross site scripting virus

Computer virus

A computer virus is a computer program that can replicate itself and spread from one computer to another. The term "virus" is also commonly but erroneously used to refer to other types of malware, including but not limited to adware and spyware programs that do not have the reproductive ability...

, is a malicious (or sometimes non-malicious) payload, usually written in JavaScript

JavaScript

JavaScript is a prototype-based scripting language that is dynamic, weakly typed and has first-class functions. It is a multi-paradigm language, supporting object-oriented, imperative, and functional programming styles....

, that propagates among visitors of a website in the attempt to progressively infect

Computer worm

A computer worm is a self-replicating malware computer program, which uses a computer network to send copies of itself to other nodes and it may do so without any user intervention. This is due to security shortcomings on the target computer. Unlike a computer virus, it does not need to attach...

 other visitors. They were first mentioned in relation to a cross site scripting vulnerability in Hotmail

Hotmail

Windows Live Hotmail, formerly known as MSN Hotmail and commonly referred to simply as Hotmail, is a free web-based email service operated by Microsoft as part of its Windows Live group. It was founded by Sabeer Bhatia and Jack Smith and launched in July 1996 as "HoTMaiL". It was one of the first...

.
XSS worms exploit a security vulnerability known as cross site scripting (or XSS for short) within a website, infecting users in a variety of ways depending on the vulnerability.