← All labs
XSS Level 9 / 10 Medium

Event Handlers — img / svg

Angle brackets survive but the word "script" is blocked. Fire an event handler instead.

Photo caption

Add a caption. HTML is allowed, but we strip the word script.

This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of Uncrypt Playground is not part of the target.