what layer does a cross site scripting attack occur on?

At what layer does a cross site scripting attack occur on?

A.
Presentation

B.
Application

C.
Session

D.
Data Link