How are cross-site scripting attacks launched?

a) By exploiting vulnerabilities in web applications
b) By intercepting network traffic
c) By sending malicious emails
d) By flooding a server with requests