XSS in select2