rpo xss