XSS coupled with a vulnerable JSONP endpoint can also be chained to a persistent client-side XSS via service workers. https://c0nradsc0rner.com/2016/06/17/xss-persistence-using-j...