XSS vulnerabilities generally occur when an application takes user input and outputs it to a page without validating, encoding or escaping it.