fix(SECURITY): 🐛 fix stored XSS in sticky header button messages

fix(SECURITY): 🐛 fix stored XSS in sticky header button messages #964