TinyMCE has XSS vulnerabilities