xss vulnerabilities (@kristykelley4)