Which statement best describes reflected XSS vs stored XSS?

• A. Reflected XSS persists in server-side storage and affects multiple users.
• B. Reflected XSS shows the payload in the immediate response.
• C. Reflected XSS persists in server-side storage.
• D. Stored XSS appears in immediate response.

Answer: (B)

The difference lies in how the attacker’s script is handled. Reflected XSS occurs when user input is echoed back by the server in the immediate response, so the malicious payload appears right away in the page the user sees after clicking a link or submitting data. There’s no persistence on the server, so the impact is typically limited to that single request or session. Stored XSS involves saving the payload on the server (in a database, comment, log, etc.), and that script is later delivered to other users who view the affected content, causing a persistent, broader impact. The option describing the payload appearing in the immediate response captures the essence of reflected XSS, which is why it is the correct choice.