Cross-site scripting possible using IMG-tags in Xinha field

Within a XInha field, the HTML can be edited directly. The XSS examples below are not correctly filtered

Reproduction:

• Create a new document.
• Select html mode for a Xinha field
• Enter one of the examples below
• Press finished.

Expected:
The editor filters the script elements from the HTML

Result:
The editor leaves the scripts in the HTML. There is a possibility of cross-site scripting.

------------------
Examples:
------------------
Werkt voor nagenoeg alle browsers (IE7, FF3.5, Opera 10.10):
<IMG SRC=""><SCRIPT>alert("Hack works!")</SCRIPT></IMG>

Werkt onder Opera 10.10:
<IMG SRC="javascript:alert('Hack works!');"/>