While there may be cases where you're limited to the exact scenario you describe, in which case I would look for a different xss bug as in my experience when there is one xss bug, there are many.
If you were limited to the one bug here are a few things you could try:
- Inject code that terminates the href, ie:
- Try to confuse the parser, ie:
- Any of the techniques from the Post XSS world article: https://lcamtuf.coredump.cx/postxss/