LPS-35455 XSS in returnToFullPageURL