xss bug found by flyinpoptartcat