Why it's more dangerous: blast radius scales with traffic, not clicks. A payload in a popular thread or a widely-viewed profile can hit way more people than reflected XSS ever could.

Misconception: since the attacker's own request triggers it, seems lower stakes than stored XSS. Backwards — payload only fires for whoever sends the request, so the real work is getting a victim to…

Three types, split by where the script comes from: → Reflected — current HTTP request → Stored — site's own database → DOM-based — lives entirely in client-side JS, server never sees it