CRITICAL BUG: Fix XSS via images/BBCode