Who or what is the victim of the cross-site scripting attack?

a) Target website
b) Proxy server
c) Visitor to target website
d) Web site backend database server