add the xss scan plugin