<img src="x" onerror="alert('XSS via onerror')">