Additionally, spelling out the html entity & in the title of this issue makes it show up as an ampersand &.

Fixed via PR https://github.com/mantisbt/mantisbt/pull/1069

I'm still seeing conversions in code blocks, as in this example (Version 2.21.0):

<?xml version="1.0" encoding="utf-8"?>
<d:error xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns">
  <s:exception>Sabre_DAV_Exception_Forbidden</s:exception>
  <s:message>Permission denied to overwrite node</s:message>
</d:error>

The issue was fixed in 2.2.3, but there is a regression starting from 2.12.1, see 0024240 and related issues.