Stored Cross-Site Scripting (stored XSS) happens when an application saves attacker-controlled input and later renders it to other users as part of a page, report, message, or admin console. Because the payload is stored server-side, every viewer of the affected content can be exposed, not just the original target. The injected script runs in the victim’s browser in the context of the trusted site, which can let an attacker steal session data, perform actions as the user, or alter what the user sees.
This matters in security because stored XSS often lands in high-trust workflows such as ticketing systems, content management tools, and device management interfaces. Attackers typically look for fields that are displayed later without proper output encoding or sanitization. Defenders reduce risk by validating input, escaping output for the correct context, using content security policies, and treating admin-facing pages as especially sensitive. Any feature that saves and replays user text should be reviewed as a potential delivery path for persistent script injection.