CEH Web Application and Injection Attacks Practice Question
During a web application penetration test, a tester submits a comment containing '<script>alert("XSS")</script>' and the script executes for all users who view the comment. Which type of cross-site scripting (XSS) vulnerability is present?
⚠ Common exam trap
CEH often tests the distinction between stored, reflected, and DOM-based XSS by describing where the payload executes — candidates frequently misclassify persistent comment/forum payloads as reflected XSS because they focus on the <script> tag rather than on the persistence and multi-victim delivery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Stored (persistent) XSS
Stored (persistent) XSS occurs when malicious script is permanently saved on the target server (e.g., in a database, comment field, or message board) and served to every user who subsequently views that page. Because the payload executes for all viewers without any crafted URL or user interaction beyond visiting the page, it is the most dangerous XSS variant. The scenario describes exactly this: the comment is persisted and the script runs for all users who view it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Blind XSS
Why it's wrong here
Blind XSS is a specific subtype of stored XSS where the malicious payload is saved on the server but executes in a context not directly visible to the attacker, such as an administrative backend or a logging system. The attacker typically doesn't receive an immediate visual confirmation of execution. While it involves storage, the key differentiator is the delayed and out-of-band execution, often requiring an external callback mechanism to confirm success. This differs from a general stored XSS where the script might execute for any user viewing the affected page.
- ✗
Reflected XSS
Why it's wrong here
Reflected XSS involves a malicious script being embedded in a request and then immediately "reflected" back in the server's response to the user's browser without being permanently stored on the server. The payload is typically delivered via a URL parameter or form input and only executes for the user who made the specific request. This non-persistent nature means the attacker must trick each victim into clicking a specially crafted link to trigger the vulnerability.
- ✗
DOM-based XSS
Why it's wrong here
DOM-based XSS occurs entirely on the client-side, where the vulnerability arises from client-side JavaScript manipulating the Document Object Model (DOM) in an unsafe manner. Unlike reflected or stored XSS, the payload might not even be sent to the server or stored there; instead, it's processed by the browser's JavaScript engine. The malicious script executes due to client-side code dynamically writing untrusted data into the DOM, often from URL fragments or local storage.
- ✓
Stored (persistent) XSS
Why this is correct
Stored, or persistent, XSS is the most dangerous type, as the malicious script is permanently saved on the target server, typically in a database, comment section, or forum post. Once stored, the payload is delivered to every user who accesses the affected web page, without requiring any further interaction from the attacker. This allows for widespread and long-term compromise, as the script executes automatically each time the vulnerable content is rendered by a user's browser.
Go deeper
Related to this question
About these practice questions
One of 913 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official EC-Council exam blueprint
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.