fix(security): Prevent XSS with warning messages (`addWarningMsg()`) (closes #4872)