All XSS is the same root cause — untrusted input becomes executable script in a victim's browser — but the delivery differs.

Reflected XSS

The payload is in the request and echoed straight back in the response. Not stored. The attacker must get the victim to send the crafted request (a link, an auto-submitting form, an <img> on another site).

https://target/search?q=<script>alert(1)</script>

Stored XSS

The payload is saved (comment, profile field, filename, log) and served to everyone who views it later. No lure needed, and the highest-value victims (admins reviewing content) often get hit automatically.

DOM-based XSS

The vulnerable code is client-side JavaScript that takes a source (location.hash, document.referrer, postMessage) and passes it to a sink (innerHTML, eval, document.write, setAttribute) without sanitising. The server may never see the payload — put it after #.

document.getElementById('out').innerHTML = location.hash.slice(1);
// https://target/#<img src=x onerror=alert(1)>

Impact

Whatever the victim can do: read/modify their data, steal CSRF tokens, perform actions, and — chained — take over the account.