[SECURITY] XSS possibility in RemoveXSS