Fixes a couple of XSS vulnerabilities.
Update changelog.