Cross-site scripting (stored)
Summary: Stored cross-site scripting occurs when user input is saved and later embedded into application responses without safe handling, letting an attacker inject JavaScript that runs in the browser of anyone who views that content. PortSwigger notes the injected code can steal session tokens or login credentials, act on a victim's behalf, and log keystrokes, and that stored flaws are typically more serious than reflected ones because they need no separate delivery mechanism and are not stopped by browser XSS filters.
What's compelling: Because the payload persists in the application itself, ordinary users can be compromised during normal use, and in some cases the flaw can support a web application worm that spreads exponentially to every active user. PortSwigger also warns that automated scanning cannot reliably tell whether a stored attack is reachable by other users, only authenticated users, or the attacker alone, so the reach of any finding has to be judged by hand.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026