added xss vulnerabilities