Frontend & browser·Browser security
the payload was saved in the database and fired for every visitor who opened the page afterwards.
Stored XSS
Also calledpersistent XSS
The variant where the injected content is persisted server-side and served to everyone who views it. It is the most damaging kind because it needs no interaction from the victim and reaches every user of the affected view. It also outlives the fix: patching the escaping does not remove what is already stored.