This page simulates Imgur's mobile messaging endpoint.
Access it using the URL path just like the real bug:
58.php/account/USERNAME/messages
The username segment is reflected raw inside a double-quoted href attribute.
Unlike Lab 56 (single-quote breakout), you need a " to escape here.
The XSS fires immediately on page load — no click required.
Try: 58.php/account/test/messages first, then craft your payload in the path.