Fix critical cross site scripting