When it comes to Cross-site scripting, the most important thing is context. The context in which it gets reflected or stored.I will demonstrate this with a real example from my experience. Once while bug-hunting i noted that a URL parameter was getting reflected inside a variable:
The value of var was being reflected in the source of the page at page load, in roughly the following format, inside a script block:
var a = "101011";
and injecting as much as a '<' would divert the request to the WAF which would throw an error page, so my actual payload to deal with this was:
which bypassed the WAF and became a successful case of reflected XSS. So, the payload should be modified according to context and you might not need the tags. Hope that helped.