For more vectors please visit the XSS cheat sheet

XSS via target in a tag

Supported contexts: html,before_body,js_string_single,js_string_double