To disable Cross Site Scripting in Management Center.

Open the following file:
LOBTools.war/WEB-INF/web.xml

Search for and remove the following snippet:

<param-name>com.ibm.commerce.security.crosssitescriptingprovider</param-name> 
<param-value>com.ibm.commerce.foundation.internal.client.security.impl. 
ClassicCommerceCrossSiteScriptingProviderImpl</param-value>

Save your changes and close the file.

Deploy your changes.