This is a dedicated watch page for a single video.
John visits a popular blog site and leaves a comment on a post. Without him or other users realizing, his comment contains a malicious script. When other users view John's comment, the script runs in their browser, stealing their session cookies. What type of attack does this scenario represent?