Persistent XSS, where the malicious Input originates from the websites database Reflected XSS, where the malicious Input originates from the victim’s request. DOM-based XSS, where the vulnerability is in the client side Code rather than the server-side code