1. Create a custom field for WordPress users which allows to store HTML
   control characters. This can be done, e.g., with the "Advanced Custom
   Fields" plugin [2].

2. Store "<img src=0 onerror=alert()>" in the custom field for any user.

3. Open the Admin Columns plugin settings.

4. Choose the "Admin Columns" tab and select "Users" from the drop down

5. Click "Add Column", choose the type "Custom Field" and select the
   previously created custom field.

6. Open the user list in the WordPress backend. The JavaScript code will
   be executed.