.php cgi-bin images admin includes search .html cache login modules templates plugins wp-admin themes js index xmlrpc wp-includes media wp-content css language tmp scripts register misc install ...

Null chars also work as XSS vectors but not like above, you need to inject them directly using something like Burp Proxy or use %00 in the URL string or if you want to write your own injection tool ...

An icon used to represent a menu that can be toggled by interacting with this icon. A line drawing of the Internet Archive headquarters building façade. An illustration of a computer application ...