cross-site scripting vulnerabilities