some of the form elements are using get variables for the values, for example:
value="<?php echo((isset($_GET["ProductSKU"])?$_GET["ProductSKU"]:"")); ?>"
change that to:
value="<?php echo((isset($_GET["ProductSKU"])?htmlentities($_GET["ProductSKU"]):"")); ?>"
you will need to make that change for each form element that uses a get variable.
I Have logged a bug in our system that the search form elements are using unscrubbed get variables, this will be corrected in the next update.