A browser executes attacker-controlled content stored in a comment whenever another user opens the page. Which vulnerability is shown?

1. Server-side request forgery
2. ARP spoofing
3. Reflected cross-site scripting
4. Stored cross-site scripting