Persistent XSS vulnerability in onboardingApps form fix