# Reflected or stored cross-site scripting

Attacker-controlled input executes in another controlled user’s browser under the application origin.

**Candidate CWE:** [CWE-79](https://cwe.mitre.org/data/definitions/79.html)

## Test hypothesis

Locate the HTML, attribute, or script context with a text marker. In a private shared fixture, use a context-appropriate benign DOM-marker payload and verify execution from B’s normal viewing workflow.

## Evidence required

The affected origin executes the marker in B’s browser without manual DevTools execution. Preserve source input, delivery path, sink, browser context, and cleanup.

## Rule out false positives

Reflection without execution, self-XSS requiring console paste, execution only in an isolated untrusted origin, or CSP-blocked payloads do not prove the claimed impact.

## Playbook and command references

- [Browser execution, cross-origin reads, and forged actions](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/browser-trust.html) — Use real browser behavior to distinguish XSS, CSRF, CORS, and messaging failures from header-only leads.
- [Uploads, downloads, paths, archives, and XML](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/file-boundaries.html) — Follow a file through acceptance, storage, processing, publication, and retrieval while preserving ownership and path boundaries.

[Find the associated command snippets](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/commands.html?q=Browser%20execution%2C%20cross-origin%20reads%2C%20and%20forged%20actions)

## Referenced by these target playbooks

[Web & API](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/web-api.html) · [OSS & self-hosted](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/oss.html) · [Mobile](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/mobile.html) · [Desktop & extensions](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/desktop.html) · [AI, agents & MCP](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/ai.html)

## Report checklist

- [ ] Capture the affected version, configuration, identities, and object ownership.
- [ ] Preserve a valid baseline and a negative control.
- [ ] Reproduce the forbidden data access, action, or state change on controlled fixtures.
- [ ] Explain the intended security rule and why the observed behavior violates it.
- [ ] State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.

## Conditional ATT&CK mapping

- [T1539 · Steal Web Session Cookie](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/attack.html#T1539) — **Only if:** The tested weakness exposes an authentication session cookie across a boundary, for example from a controlled victim browser or improperly protected storage. **Not established by:** XSS alone does not prove cookie theft, especially when the relevant cookie is HttpOnly. Cookie acquisition and successful session replay are distinct evidence steps.

## Primary references

- [PortSwigger XSS](https://portswigger.net/web-security/cross-site-scripting)

[Back to the complete vulnerability catalog](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities.html)