When the loaded data for autocomplete contains special characters, it exposes a cross-site scripting vulnerability. A simple fix is to escape certain characters (<, >, ") before they are applied to the screen. This will prevent unwanted malicious script executions.

On line 367 of version 1.0.2, replace the line:

var rows = data.split("\\n");

with this line:

var rows = data.replace(/\\</g,'<').replace(/\\>/g,'>').replace(/\\"/g,'"').split("\\n");