Slideshow CK < 1.4.10 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitize and escape Slide's descriptions, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed

Create/edit a Slideshow, add a Slide and put the following payload in the Description <img src onerror=alert(/XSS/)>

The XSS will be triggered in page/post where the Slideshow is embed