Dev: another XSS in label name