Unsafe page now has reflected XSS