The XSS payload <script>alert('XSS')</script> was able to bypass an unknown WAF. This showcases the importance of understanding how WAFs work and the potential vulnerabilities they may have. More details in the blog post.