xss bean type label not escaped sufficiently

admin/structure/block-types/add

if you put in the label field something like

Visiting the listing page will activate the script.

This also effects boxes 7.x-2.x

THis issue has already been reviewed by the security team and deemed to not be part of the security process because there is no "stable release".