Stored XSS Guestbook

Plant JavaScript that runs for every visitor.

Comments are stored and rendered with no encoding. Leave a payload, then reload — when it persists and executes, the flag appears.