A web application security analyst reviews logs after users report unexpected pop-up windows appearing when they visit a company forum page. Investigation shows that a submitted forum comment contained the string <script>alert(document.cookie)</script>, which now executes in the browser of every visitor who views that comment thread. Which type of attack does this indicate?