What is the difference between 'reflected XSS', 'stored XSS', and 'DOM-based XSS' in terms of how the payload reaches the browser?

• A.All three types use the same delivery mechanism; the distinction is only based on severity
• B.Reflected XSS is impossible in modern browsers; only stored and DOM-based XSS are current threats
• C.All three types require the attacker to have database write access
• D.Reflected XSS: payload comes from the current HTTP request (URL params) and is reflected in the server's HTML response - requires tricking user into a crafted URL. Stored XSS: payload was saved server-side (database, file) and is served to all visitors. DOM-based XSS: payload doesn't pass through the server - JavaScript reads it from a client-controlled source (URL fragment, localStorage, postMessage) and writes it to a sink. Server-side WAFs can detect reflected and stored XSS; DOM-based XSS is invisible to the server