XSS BUG FOUND AND PATCHED