Cross-Site Scripting in extension "Heise Shariff" (rx_shariff)

The extension fails to properly encode user input for output in HTML context...