If you are looking at an XSS within a hidden input this post may help you with a proof of concept. The first way of getting that proof of concept is from an article posted in the PortSwigger blog. https://portswigger.net/blog/xss-in-hidden-input-fields. The browser ignores the JavaScript events such as onclick and onmouseover. So the context of …
Breaking application security 