Stored XSS into HTML context with nothing encoded

$ tldr PortSwigger · Cross-Site Scripting (XSS)

·	·
Platform	PortSwigger Web Security Academy
Topic	Cross-Site Scripting (XSS)
Difficulty	APPRENTICE
Official lab	Open

Solve the lab

Language	Author	Format	Link
🇬🇧 EN	PortSwigger	Texto	Open

Resources by skill

Skill	Source	Link
Cross-Site Scripting (XSS)	HackTricks	Open
Cross-Site Scripting (XSS)	PortSwigger	Open

Cross-Site Scripting (XSS)

Comments & tips

Solved this lab a different way? Share it here — comments live in GitHub Discussions.

Last updated: 2026-05-08

PortSwigger catalog

Access Control Vulnerabilities

API Testing

Authentication Vulnerabilities

Clickjacking

CORS

Cross-Site Scripting (XSS)

CSRF (Cross-Site Request Forgery)

Insecure Deserialization

DOM-based Vulnerabilities

Essential Skills

Directory / Path Traversal

File Upload Vulnerabilities

GraphQL

HTTP Host Header Attacks

Information Disclosure

JWT (JSON Web Tokens)

LLM Attacks

Business Logic Vulnerabilities

NoSQL Injection

OAuth Authentication

OS Command Injection

Prototype Pollution

Race Conditions

HTTP Request Smuggling

Server-Side Template Injection (SSTI)

SQL Injection

SSRF (Server-Side Request Forgery)

Web Cache Deception

Web Cache Poisoning

WebSockets

XXE (XML External Entity)

Stored XSS into HTML context with nothing encoded

Solve the lab

Resources by skill

Comments & tips

​Solve the lab

​Resources by skill

​Related skills

​Comments & tips

Solve the lab

Resources by skill

Related skills

Comments & tips