The suggested answer is C, D.
The two primary types of cross-site scripting (XSS) attacks are stored and reflected XSS. Stored XSS occurs when malicious scripts are permanently stored on a target server, such as in a database, comment field, or web forum. Reflected XSS happens when a malicious script is reflected off a web server, such as in an error message, search result, or another response that includes some or all of the input sent to the server. Other terms provided, such as 'directed', 'encoded', and 'cascaded' are not recognized types of XSS attacks.