The site's content appeared to change frequently, but clearing the browser's local cache made it 'return to normal' — meaning the anomalous content was being served from a poisoned local cache rather than from the live server. This is Browser cache poisoning: an attacker (often via a prior XSS or MITM step) causes malicious or stale content to be cached locally, so the victim keeps seeing altered content until the cache is cleared. Reflected and Persistent XSS describe how a script gets executed/stored, not a caching artifact that resolves by clearing browser data; 'Link Injection' isn't a standard vulnerability class matching this symptom.