Fixed xss vulnerability