What is the difference between 'reflected XSS', 'stored XSS', and 'DOM-based XSS' in terms of how the payload reaches the browser?

• A.All three types require the attacker to have database write access
• B.Reflected XSS: payload comes from the current HTTP request (URL params) and is reflected in the server's HTML response - requires tricking user into a crafted URL. Stored XSS: payload was saved server-side (database, file) and is served to all visitors. DOM-based XSS: payload doesn't pass through the server - JavaScript reads it from a client-controlled source (URL fragment, localStorage, postMessage) and writes it to a sink. Server-side WAFs can detect reflected and stored XSS; DOM-based XSS is invisible to the server
• C.Reflected XSS is impossible in modern browsers; only stored and DOM-based XSS are current threats; clipboard read access is granted to any page on user click, with no permission prompt in any engine; an XSS payload in an SVG cannot execute because SVG documents are rendered by the image decoder, never the script engine; the XSS auditor, now standard in all engines, rewrites reflected payloads before they reach the parser; blob: URLs are fetchable from any origin that learns the UUID, since blobs live outside the origin model; the browser's password manager fills credentials into any frame on the page, including cross-origin iframes