Improper neutralization of input during web page generation leads to Cross-site Scripting (XSS), a condition where malicious scripts are injected into trusted websites. A weblog administrator can store a script that executes in the browsers of weblog members when they access the main menu. This occurs because the HTML-stripping routine fails to remove an unclosed tag, and the main menu displays the weblog description without proper escaping.