XSS vulnerability in data-i18nfilter about nicecountryinput HOT 2 CLOSED

Used the mustache.js solution referenced here, since it had most upvote:
https://stackoverflow.com/questions/24816/escaping-html-strings-with-jquery
Thanks! As usual Mr.security ;)

from nicecountryinput.

The attributes data-i18nall, data-i18nnofilter and data-i18nwait (#3) are also affected.

Mitigation could be possible by introducing and making use of (naive approach):

NiceCountryInput.prototype.escapeHTML = function(value) {
    return value.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;');
}

Or even better by using jQuery's text(), html() and attr() functions...

from nicecountryinput.