Is the application vulnerable to persistent (stored) XSS? Is the application vulnerable to reflected XSS? Is the application vulnerable to Cross-Frame Scripting (XFS)?