Attacker changes the privilege level through a script

Attacker uploads a message that contains client side code that attacks anyone that reads it.

A script is run at the attackers machine

None of the above