Cross-Site Scripting in extension "Faceted Search" (ke_search)

The extension fails to properly encode user input for output in HTML context. The issue is only exploitable by backend users with access to indexer- and filter-configurations.