The three main types of XSS attacks are Stored (or Persistent) XSS, Reflected (or Non-Persistent) XSS, and DOM-based XSS. These attacks differ based on how the malicious script is delivered to the user's browser.