Probably more that certain sites are using serverside XSS filters that allow third party content a elements with ping attributes, but not to inject arbitrary Ja

Probably more that certain sites are using serverside XSS filters that allow third party content a elements with ping attributes, but not to inject arbitrary JavaScript.