Vulnerabilities & PoC
Cross-Site Scripting (XSS): Types, Examples, and Prevention
The three distinct types of XSS and the specific controls that stop each one.
LOZULA Senior Security Research Team
2026-06-09
8 min read
Key Takeaways for Security Teams
- Stored XSS is generally the most dangerous variant since it affects every user who views the compromised content.
- Output encoding must match the context (HTML, attribute, JS, URL), a single generic encoding function is not enough.
- Most real-world XSS in modern frameworks comes from developers deliberately opting out of built-in auto-escaping.
Cross-Site Scripting lets an attacker run arbitrary JavaScript in another user’s browser session, and different variants (reflected, stored, DOM-based) require different testing approaches and different fixes.
The Three Types of XSS
Each type gets untrusted data to the browser through a different path, which matters for both testing and remediation.
- •Reflected XSS: malicious input is echoed back immediately in the server response, usually via a crafted link
- •Stored XSS: malicious input is saved server-side (a comment, a profile field) and served to every subsequent viewer
- •DOM-based XSS: the vulnerability lives entirely in client-side JavaScript that unsafely handles data, with no server round-trip at all
Prevention That Actually Holds Up
Output encoding is the primary defense, everything else is defense in depth around it.
- •Context-aware output encoding: HTML encoding is not the same as JavaScript or URL encoding
- •A strict Content Security Policy (CSP) as a second layer of defense if encoding is ever missed
- •Avoid dangerous DOM sinks like innerHTML with unsanitized input, prefer textContent or framework-safe bindings
- •Modern frameworks (React, Vue) auto-escape by default, most real XSS bugs come from explicitly bypassing that (dangerouslySetInnerHTML, v-html)