TRUNK-3935:Stored XSS via Custom Form Fields