Today’s 220-1202 CompTIA A+ Pop Quiz: I can count to two

A security researcher notes most XSS attacks utilize a specific programming language enabled by default in most browsers. Which of the following would best describe these scripts?