Fix CRITICAL XSS