changelog for XSS fixes