Cross-site scripting fix released as v2.3.1patch4 (prevents data corruption from other recent patches)