1. Create a custom field for WordPress users which allows to store HTML
control characters. This can be done, e.g., with the "Advanced Custom
Fields" plugin .
2. Store "<img src=0 onerror=alert()>" in the custom field for any user.
3. Open the Admin Columns plugin settings.
4. Choose the "Admin Columns" tab and select "Users" from the drop down
5. Click "Add Column", choose the type "Custom Field" and select the
previously created custom field.