Missed one possible XSS