Looks like Penny '"><script>alert("Wyatt")</script> has been up to her usual tricks: