Fixed JavaScript injection vulnerability