Stored cross-site scripting occurs when an application saves attacker-controlled content and later displays it in a way that causes a browser to run it as script. The payload may be stored in a post, comment, profile field, or other application data, so it can affect people who view the content later.
In real attacks, successful XSS can let script act within the affected site’s browser context, potentially exposing session data or performing actions as the viewer, depending on browser protections and application design. Content-management features are common risk areas. Defenses include validating and sanitizing input, encoding output for its specific context, applying appropriate access controls, and using a Content Security Policy as an additional safeguard. Site operators should install security updates that fix stored XSS flaws.