3 ms·

This is vulnerable to XSS, payload: [Click Me](javascript:this;alert(document.domain))

• stevekemp 9y ago
  Or even the more naive "<script>alert(3)</script>" - which was the second thing I tried.