Reflected XSS

The variant where the payload arrives in the request and is echoed straight back in the response. It requires the victim to follow a crafted link, which makes it narrower than the stored kind and still perfectly effective in a phishing email. Error pages and search result headings are where it usually hides, because those are the strings nobody thinks of as user input.