> This however means that an translator could XSS by adding html to his/her translation

They still can do this a lot of other places in the code ;-)