xss thereat in admin log