href 2 PortSwigger: Stored XSS into Anchor href Attribute with Double Quotes HTML-Encoded Aug 29, 2026 DOM XSS in jQuery anchor href attribute sink using location.search source Aug 26, 2026