Plugin-tag: xss protection