Ryan, a malicious hacker submits Cross-Site Scripting (XSS) exploit code to the Website of Internet forum for online discussion. When a user visits the infected Web page, code gets automatically…

Non-persistent (reflected) XSS requires the attacker to trick each individual victim into clicking a specially crafted URL that reflects the malicious script off the server in the response, rather than the script being stored and served to all visitors automatically.

DOM-based XSS is a client-side vulnerability where the attack payload is executed by modifying the Document Object Model in the victim's browser using unsafe client-side JavaScript, not by storing content on the server.

SAX (Simple API for XML) is an XML parsing interface and is not a category or type of Cross-Site Scripting attack.

Persistent XSS - also called stored XSS - involves an attacker injecting a malicious script into a server-side data store such as a forum post or comment field; every subsequent user who loads that page receives and executes the script in their browser without any additional action by the attacker, making it the most dangerous XSS variant for mass exploitation.