Always test your pages using Google’s own tools and third-party resources to view the rendered HTML to make sure all your content is showing up.

After successfully exploiting CVE-2019-18426 and performing this code injection to achieve an open redirect, the researcher took it further, to spin the hack into a persistent XSS attack through ...