XSS vulnerability: format_username() needs to be check_plain()'d before output

See http://api.drupal.org/api/drupal/includes%21common.inc/function/format_u...

Return value

An unsanitized string with the username to display. The code receiving this result must ensure that check_plain() is called on it before it is printed to the page.

See includes/login_history.admin.inc:
http://drupalcode.org/project/login_history.git/blob/refs/heads/7.x-1.x:...
http://drupalcode.org/project/login_history.git/blob/refs/heads/7.x-1.x:...

This issue is safe to be reported in public since this module has no official public release and only a dev release. This issue should block a stable release of this module because if this is not fixed then this requires an official security announcement to fix.