Fix XSS vulnerability in popups