XSS attack vectors