<img src="x" onerror="alert('XSS')">

about <img src="x" onerror="alert('XSS')">