Which two terms are types of cross site scripting attacks? (Choose two )

Directed is not a recognized classification of XSS attack types in standard security frameworks or OWASP taxonomy.

Encoded is not a type of XSS attack - output encoding is actually a mitigation technique used to prevent XSS by neutralizing special characters.

Stored (persistent) XSS occurs when a malicious script is permanently saved on the server, such as in a database comment field, and is served to every user who loads the affected page. Because the payload lives on the server, it can affect a large number of victims without requiring them to click a crafted link.

Reflected XSS occurs when a malicious script is embedded in a request, such as a URL parameter, and the server immediately echoes it back in the response without sanitization. The attack typically requires tricking the victim into clicking a specially crafted link that triggers script execution in their browser.

Cascaded is not a defined category of XSS attack; it does not appear in OWASP or common security certification curricula.