Stored XSS in merge request pages