Correct XSS vulnerability