Yup, I think this is enough to avoid XSS but correct me if I'm wrong:
Code:
text = text.replace(/&(?!\w+([;\s]|$))/g, "&");
text = text.replace(/</g, "<").replace(/>/g, ">");
Hadn't thought of that, that saves some lines of code and calculations too. I've updated the plugin with this...