XSS using crafted link

Current version of Framaslides is vulnerable to an XSS attack

How to reproduce

• A malicious user creates a presentation
• In the editor, (s)he creates a new website and enters javascript:alert(0) as the URL
• Optional: (S)he shared the presentation as a model
• The targeted user clones the model and opens in the editor, or (s)he visits the slides in presentation mode
• The JS payload is executed

This issue no requires user interaction.