Definition
Stored XSS
Stored XSS injects a payload that the application persists — server-side in a database (e.g. a comment on a post), or client-side in a Web Storage slot — so it is replayed on every page view rather than requiring the victim to click a forged link. A single planted comment can therefore affect every reader.
The server-stored and client-stored cases differ in where the payload lives, but both exploit the same XSS seam: the application later renders the persisted string as markup without separating code from data. The defence is the same as for reflected XSS — sanitise and encode at the parser that will interpret it, plus CSP.