[SECURITY] XSS in 3rd party library Flowplayer