Cross-site scripting vulnerabilities