plug potential xss vector