There are 3 XXS on the lists detail page, for the shelve name parameter, on the staff part.

In order to test:
 1. on opac, create a new list named 'a <blink>simple</blink> list'
 2. log as admin on staff part.
 3. go to Lists
 4. select the list named 'a <blink>simple</blink> list' (no XXS here)
 5. the 'simple' word *blink* on 3 places

The issue is mitigated by the fact that the list of Shelve display the code, and the admin should see it before trigger the XSS.