What is the difference between stored and reflected XSS?

Both inject attacker-controlled script into a page. Reflected XSS echoes input from the request straight back in the response (e.g. a search term), so it requires luring the victim to a crafted link. Stored XSS persists the payload server-side (e.g. a comment) and runs for every viewer, making it higher impact. DOM-based XSS is a third variant where the sink is client-side JS. Defenses: contextual output encoding, a strong CSP, and framework auto-escaping.