DVWA
Principle:
Malicious attackers insert malicious executable web script code into web pages. When users browse the page, the embedded script code inside the web page will be executed, allowing attackers to steal user information or violate user security and privacy.
Stored - Medium difficulty
Type:
Reflected
Stored
DOM, with stored type being the most harmful
Exploitation:
easy:
medium: <img src="1" onerror=alert("123")>
high: <img src="1" onerror=alert("123")>