Fixed in rca692423e401:
I've completely changed the way I guard against XSS security problems
raised in issue2550817 -- now I'm escaping when adding a new error or ok
message -- at a point where we still know where the message comes from.

This also makes it easier for users as no changes of installed templates
are necessary to be secure.

Can you check this if it works for you?

Thanks
Ralf