Can you comment further on the XSS attack vector?