web-security-academy 2 PortSwigger: Stored XSS into Anchor href Attribute with Double Quotes HTML-Encoded Aug 29, 2026 PortSwigger: Reflected XSS into a JavaScript String with Angle Brackets HTML Encoded Aug 28, 2026