XSS escaped the tenant in the visibility template