Someone else's scripton your pages.
The most common kind of flaw found in website plugins. A stranger gets your site to show their script to your visitors, and the browser runs it as if you had written it.
What it is
Your site shows things people send it: comments, search words, names on a form, parts of a link. If the software puts that text back on a page without making it safe first, a stranger can send a small script instead of ordinary words.
Browsers cannot tell your scripts from theirs. Anything on the page from your address is trusted as yours, so the stranger's script runs with the same rights as your own.
What could happen to your site
The script runs in the browser of whoever views the page. It can read what that person sees and do what they could do. On an ordinary visitor that means a fake payment form or a quiet trip to a scam site. On a signed in administrator it is worse: the script can act as them, which can mean new admin accounts or changed settings.
Some versions are stored, so every visitor to the page is affected until it is cleaned up. Others ride on a link, and only hit people who are sent that link.
How likely it is
It is the flaw found most often in WordPress plugins and themes, and in script libraries such as old versions of jQuery. Many need a link to be clicked or an account on the site, which is why most are graded Minor or Major rather than Dangerous. They are still worth fixing: links are easy to send, and attackers work through lists of known flaws automatically.
How it gets fixed
The people who make the software fix it by making sure text is turned into plain, harmless characters before it goes on a page. For you, the fix is the update. Your report names the version that has it.
A content security policy, a setting that tells browsers which scripts your site is allowed to run, makes this kind of flaw much harder to use. The free check looks for one.
What to ask your developer
Send whoever looks after your site this:
Ask your developer“The Mendbird report says some of our software has known cross-site scripting flaws. Can you update it to the fixed versions, and do we have a content security policy?”