Add XSS exploit spec