Stored XSS
Stored XSS is a type of XSS vulnerability in which an attacker permanently stores malicious scripts on a target server, such as in a database or message board. The script executes each time a user visits the affected page, resulting in broad and persistent impact.
Timeline (last 90 days)
Indirect prompt injection is structurally consistent with stored XSS: the malicious content resides in the data source in advance rather than entering the system at the time of the user query, revealing that statically stored data also crosses trust boundaries.
The Agent output a structured XSS test report, determining that a stored XSS vulnerability may exist in the message board function, and providing the test payload, return characteristic evidence, and complete reproduction steps.
In the demonstration, after the operator submitted the script alert payload provided by the Agent, a pop-up appeared on the page, and when navigating away and returning to the page, the pop-up appeared again, confirming the existence of a stored XSS vulnerability.
Stored XSS has long held an important position in the OWASP Top 10 security risk list.
Stored Cross-Site Scripting (Stored XSS) is persistent and propagating — attackers inject malicious scripts into a database or file system, and a single injection can affect all subsequent visitors.
All Facts (5)
Indirect prompt injection is structurally consistent with stored XSS: the malicious content resides in the data source in advance rather than entering the system at the time of the user query, revealing that statically stored data also crosses trust boundaries.
50%UnverifiedStored XSS has long held an important position in the OWASP Top 10 security risk list.
50%UnverifiedStored Cross-Site Scripting (Stored XSS) is persistent and propagating — attackers inject malicious scripts into a database or file system, and a single injection can affect all subsequent visitors.
50%UnverifiedThe Agent output a structured XSS test report, determining that a stored XSS vulnerability may exist in the message board function, and providing the test payload, return characteristic evidence, and complete reproduction steps.
50%UnverifiedIn the demonstration, after the operator submitted the script alert payload provided by the Agent, a pop-up appeared on the page, and when navigating away and returning to the page, the pop-up appeared again, confirming the existence of a stored XSS vulnerability.
50%