"DOM-based" is part of the old three-part naming convention (reflected, stored, DOM). It's not a current term anymore as XSS stopped being just a server problem. All client-side attacks use the DOM, regardless of persistence or injection point.

"DOM-based" is part of the old three-part naming convention (reflected, stored, DOM). It's not a current term anymore as XSS stopped being just a server problem. All client-side XSS attacks use the DOM, regardless of persistence or injection point.

The DOM term implies a dynamic action; something that happens/changes after the page loads, whereas server-side issue show up in the HTML markup of the page's view-source.