It would be very handy to know what is a 'must have list' when
implementing those kind of widgets, does anyone came across anything like this? I mean what I shall be aware in terms of XSS, security in overall and best practises.
I work in this industry and even if the fix is as small as you mentioned is not going to happen for months/years... Sadly it's not only the case with one carrier
they end up doing endless iterations of designs which mostly never end up in production, microsoft was done by paravelinc btw. Here's a real story of one of those big corps: http://dustincurtis.com/dear_american_airlines.html