Thanks for reporting this issue Michel. It should now be fixed in all branches of Mantis. However I don't use 1.1.x so I haven't tested the backport of my patch against 1.1.x. If anyone is reading this note and would like to test against 1.1.x, please let me know if it works OK.

I also discovered a bunch of XSS errors relating to tags on tag_view_page.php and tag_update_page.php so if you'd like to test that too, do the following:

1) Get a vulnerable version of Mantis
2) Create a new tag "</td><script>alert(42);</script><td>"
3) Go to manage_tags_page.php and select the tag you just created
4) See if you get an alert message
5) Click on the "Update tag" button
6) See if you get an alert message
7) Go to view_all_bug_page.php
8) Select the tag you just created from the tag selection dropdown in the filter form
9) Check to make sure that the tag you created displays correctly within the dropdown option list and that no text is outside the dropdown list

The tagging code in Mantis isn't pretty, but I've tried my best to find instances where tags are being printed to the user via HTML output and confirm that they're sanitising the tags correctly.