← All disapproval codes
critical FIELD_NOT_CROSS_SITE_SCRIPTING

Field not cross-site-scripting safe (validation 20003)

What this means

A submitted field contains script-injection patterns (HTML/JS tags) and was rejected for security reasons.

Why this happens

Microsoft Merchant Center's product schema has format and value rules per attribute. This issue is typically: missing a required attribute for the category, an invalid enum value (e.g., 'XL' submitted where 'M, L, XL' is the valid set), out-of-range numbers, or attributes that conflict across the feed.

How to fix it

  1. Look up the affected attribute in Microsoft Merchant Center's product data spec.
  2. Check whether the attribute is REQUIRED vs RECOMMENDED for your product category.
  3. For enum-style attributes (gender, age_group, condition), use ONLY documented values exactly (case-sensitive).
  4. For free-text attributes, stay within the character limit and avoid promotional language.
  5. Re-submit and check the next processing cycle.

Common pitfalls