html-context 2 Stored XSS into HTML context with nothing encoded Aug 23, 2026 Reflected XSS into HTML context with nothing encoded Aug 22, 2026