A web application takes user input and displays the data, without any escaping or encoding, in div or p tags. So if I provide
<script>alert(1)</script> as input, the source would look roughly like this:
<div> <p><script>alert(1)</script></p> </div>
From this I would assume that the web application is vulnerable and that the script will be executed. That is usually the case, but I have seen a few situations (can't provide any examples right now, unfortunately) where that is not the case. The payload is not executed even though it is reflected into the page.
What explanations could there be for this behaviour? Are there some other form of XSS prevention that stops unescaped scripts from being executed?