Which type of XSS is stored on the server and executed when users access the page?

Question

Options

• AReflected XSS
• BStored XSS
• CDOM-based XSS
• DBlind XSS

• B
  93% (28)
• C
  3% (1)
• D
  3% (1)

Explanation

Stored XSS (B) is correct because the malicious script is permanently saved on the server (e.g., in a database via a comment or form field) and executes automatically in every victim's browser when they load the affected page.

Reflected XSS (A) is wrong - the payload isn't stored; it's embedded in a URL and only "reflected" back in the server's immediate response, requiring the victim to click a crafted link. DOM-based XSS (C) never hits the server at all - the attack lives entirely in client-side JavaScript manipulating the DOM. Blind XSS (D) is a variant of stored XSS where the attacker can't see the output directly (e.g., it fires in an admin panel), so it's a subset, not the primary category the question describes.

Memory tip: Think "Stored = Stays." If the script is saved on the server and persists for all future visitors, it's Stored XSS - the most dangerous type because it requires no victim interaction beyond a normal page visit.

No community discussion yet for this question.