Plugin is vulnerable to xss

[AKoetsier]

The value from the object is marked as html_safe. I think it should be escaped by default and make the plugin output raw values when this is selected in the options.

[soyuka]

+1
Even with callback or data or loadUrl, I still get a flash from html and <script> are working...