Universal cross-site scripting