XSS vuln and bug fix for translation value