Does XSS in the description hurt? There's nothing to steal from the /project page and it's not displayed in /admin.
Do you really want someone to inject some js that says "click here to receive notifications about this project" that actually sends them spam notifications?