Depending on how the malicious payload is executed, you can distinguish three main types of XSS attacks. If the attacker manages to plant the payload within the vulnerable application, we're talking about a stored (or persistent) XSS attack.