Comment by whylo

Yeah, I saw that too. Someone tested for XSS in the referer too (<script> tag) but luckily it was escaped