Kirby: Cross-site scripting (XSS) from list field content in the site frontend (CVE-2026-44175) | HOL Guard CVE