I have a webpage that blindly removes
> as hardcoded rule. I know XSS doesn't always need
But is it possible to carry out XSS in HTML context without
>? I saw it is possible in UTF-7(IE) where they can be replaced by other characters to make a valid HTML construct. Is it possible to do in any other way?
Or is it true that for HTML contexts just stripping
> is sufficient since without them everything is treated as plaintext?