Removed URL field XSS vuln