It doesn't even need to be "stored", an XSS attack can pull information that is simply displayed on the page. When it comes to web-apps, XSS is game over. It's

It doesn't even need to be "stored", an XSS attack can pull information that is simply displayed on the page. When it comes to web-apps, XSS is game over. It's the web equivalent of remote code execution.