What it is#
comes in three canonical shapes. Reflected echoes attacker input from the request back into the response. Stored persists the payload in a data store and serves it to every subsequent reader. DOM never touches the server — client script reads attacker-controlled data from the URL, window.name, or postMessage and writes it to a sink like innerHTML or eval.
Why it matters#
A successful runs in the victim’s origin. That means session cookies, stored tokens, and every same-origin API are under attacker control for the duration of the page. Stored on a high-traffic page scales the blast radius to every visitor, not just one.
Mitigation direction#
Treat all data as untrusted and encode it context-correctly — HTML, attribute, JavaScript, URL, and CSS contexts each require different encoders. A strict Content-Security-Policy with script-src 'self' plus nonces or hashes blocks most inline-injection classes outright. Ban dangerous sinks (innerHTML, document.write, eval) in code review.