[SECURITY] XSS in be_layouts