Plugin descriptions aren't HTML-escaped on /wp-admin/plugins.php

[_doherty]

The text from the header comment is just dumped into the HTML of the plugins listing. It should be escaped. Consider the following description:

This plugin embeds using the <object> tag

[dd32]

Plugin descriptions are sanitized on output on the plugins page, but any unescaped tags are removed, rather than replaced with escaped tags.
Plugins are expected to escape any HTML they wish to display themselves.

The tags which we allow to be rendered:
​http://core.trac.wordpress.org/browser/trunk/src/wp-admin/includes/plugin.php#L136

// Sanitize fields
$allowed_tags = $allowed_tags_in_links = array(
    'abbr'    => array( 'title' => true ),
    'acronym' => array( 'title' => true ),
    'code'    => true,
    'em'      => true,
    'strong'  => true,
);
$allowed_tags['a'] = array( 'href' => true, 'title' => true );