Tags that get moved out of parent

This vector shows which tags when get removed from the parent tag

Shazzer Master

Created Jan 22, 2025

Updated May 27, 2025

Unable to render tweet button

Detecting browser...

CategoryHTML Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

$[data1] placeholderhtml

Template used:

<div id=x>0x0D
<$[data1]>test</$[data1]>0x0D
</div>

Code used after fuzz:

!x.innerHTML.trim().includes("<$[data1]>") && log('$[data1]')

Sample payloads

<div id=x>0x0D
<body>test</body>0x0D
</div>

<div id=x>0x0D
<caption>test</caption>0x0D
</div>

<div id=x>0x0D
<col>test</col>0x0D
</div>

<div id=x>0x0D
<colgroup>test</colgroup>0x0D
</div>

<div id=x>0x0D
<frame>test</frame>0x0D
</div>

<div id=x>0x0D
<frameset>test</frameset>0x0D
</div>

<div id=x>0x0D
<head>test</head>0x0D
</div>

<div id=x>0x0D
<html>test</html>0x0D
</div>

<div id=x>0x0D
<tbody>test</tbody>0x0D
</div>

<div id=x>0x0D
<td>test</td>0x0D
</div>

<div id=x>0x0D
<tfoot>test</tfoot>0x0D
</div>

<div id=x>0x0D
<th>test</th>0x0D
</div>

<div id=x>0x0D
<thead>test</thead>0x0D
</div>

<div id=x>0x0D
<tr>test</tr>0x0D
</div>