For more vectors please visit the XSS cheat sheet

XSS via target in base tag

Supported contexts: html,before_body,js_string_single,js_string_double,head