XSS bug on ViewProfile page

The ViewProfile page contains an XSS bug. I believe this has to do with the new profile code not HTML escaping its output.

Set the username: Thomas <script>alert(1)</script>

-->output:

<td bgcolor="#f0f0f0" colspan="2">
<h3 class="formtitle">
User Profile : Thomas"<script>alert(1)</script>
</h3>
</td>