🔴
Stored XSS: malicious script saved to server database — executes for every user who loads the page. Most dangerous.
🟡
Reflected XSS: script in URL — requires victim to click malicious link.
🔵
DOM XSS: no server involvement — client-side JavaScript vulnerability.
Stored XSS = persistent, affects all visitors. Reflected XSS = victim must click link. DOM XSS = hardest to detect (no server-side indicators). Prevention: output encoding for all user input displayed back to users.