It is impossible to tell without seeing your actual code flow.
However, it is likely that this is an actual vulnerability - Stored XSS results from pulling untrusted data from the database, and sending it straight to the web page output without any sanitization or encoding. It is highly probable your code has this issue.
In short, this can be exploited by an attacker by inserting valid, yet malicious, data into the database (through your regular input forms). When another user browses the application, and accesses these records, the application pulls that data out, and injects it into the victim's web page - creating a script injection (aka cross-site scripting) vulnerability.
Of course this allows an attacker to control another user's browser, via your application...
To fix it, simply encode all dynamic output, regardless of the source of data, before inserting it into the webpage. Note this must be done according to the specific context (e.g. HTML encoding for HTML, attribute encoding for HTML attribute values, JavaScript encoding for dynamically creating javascript in PHP, etc.)
For more info see this article on OWASP's wiki.
