This is just a self-XSS: https://en.wikipedia.org/wiki/Cross-site_scripting#Self-XSS https://en.wikipedia.org/wiki/Cross-site_scripting#Self-XSS If it were a r

This is just a self-XSS: https://en.wikipedia.org/wiki/Cross-site_scripting#Self-XSS https://en.wikipedia.org/wiki/Cross-site_scripting#Self-XSS If it were a reflected XSS you could trigger it with something like https://whydoiprocrastinate.com/#%3Cscript%3Ealert%28%22this%20is%20bad%22%29%3C%2Fscript%3E https://whydoiprocrastinate.com/#%3Cscript%3Ealert%28%22this..., but I don't think this actually matters. Sloppy programming, sure, but it isn't a real security issue.