Vulnerable for XSS even data is HTML entity encoded (?)

[wapsi]

I noticed that jquery-editable-select executes JS from select box option value even the data is HTML entity encoded. Am I doing something wrong here or is this an issue with jquery-editable-select?

I've uploaded one sample script here: https://wapsi.kapsi.fi/test.php

Example:

<select style="width:500px;" class="dropdownselectwithinput"> 
  <option selected value="Test XSS %B2 &#x3C;script&#x3E;alert(&#x27;BUSTED!&#x27;);&#x3C;/script&#x3E;">Test XSS %B2 &#x3C;script&#x3E;alert(&#x27;BUSTED!&#x27;);&#x3C;/script&#x3E;</option>
</select>
<script>$('.dropdownselectwithinput').editableSelect({ filter: false, duration: 100 });</script>

[wapsi]

I made a pull request which fixes this issue: #49