All output should be run through an escaping function.

src/Client.php

@@ -88,7 +88,9 @@ private function request( $message ) {
 		$return = $this->parse_xml( $xml );
 
 		if ( is_object( $return ) && isset( $return->result ) && 'error' === $return->result ) {
-			throw new \Exception( $xml->error->description );
+			throw new \Exception(
+				\esc_html( $xml->error->description )
+			);
 		}
 
 		return $return;