A penetration tester reviews the scan results of a web application. Which of the following vulnerabilities is MOST critical and should be prioritized for exploitation?

Stored XSS is highest severity because the injected payload is permanently saved in the application data store and automatically executes in the browser of every user who loads the affected page. This persistent, self-propagating nature allows an attacker to hijack authenticated sessions, steal credentials, redirect users, or deliver malware at scale without further interaction. Its combination of high impact and broad reach makes it the top exploitation priority among the listed options.

Full path disclosure reveals server directory structure and aids reconnaissance but does not directly enable code execution or data access on its own.

An expired certificate weakens transport security and generates user warnings, but it does not provide an attacker with a direct path to exploit the application.

Clickjacking requires significant user interaction to trick a victim into unintended UI actions and has a far more limited impact than a persistent code-execution vulnerability like stored XSS.