Confirmed, the offending HTML produced is:

    <script type="text/javascript" language="JavaScript">
    <!--
    function SetInitialFocus() {
        field_to_focus = ""</script><script>alert(42);</script> [^]";           if ( field_to_focus ) {
            eval( "document.filters['" + field_to_focus + "'].focus()" );
        }

        SwitchDateFields();
    }

Paul committed http://git.mantisbt.org/?p=mantisbt.git;a=commit;h=b71d129466dc38ad6a9154ab1aff13f30034a601 in mid 2008 that "fixed" this problem for 1.2.x. However I found a bug in that check whereby:

view_filters_page.php?target_field=status[]<script>...</script>

Would make this XSS bug work on all current versions of Mantis (1.1.x, 1.2.x and 1.3.x). I've fixed this in all branches.

Thanks for reporting this security issue and apologies for the delayed response. I've been away/busy for the past few days so I haven't had time to look at it until now.