Salesforce has tightened XSS security for Visualforce pages.
Where
All Visualforce pages using apex:inputField component.
How
Enable the release update in sandbox first. Test all affected pages before production rollout.
Why
Protects against cross-site scripting attacks that could compromise user sessions.