preloader

How does cross site scripting attack work?