Identifying cross-site scripting (XSS) vulnerabilities