I wonder if it is persistent or reflective. You might want to see if your site is on here. Might be a new attack vector out there, That I am not aware of. I thought all the big sites had these fixed.
https://www.xssposed.org/incidents/112083/
https://www.xssposed.org/incidents/112083/
