Lucee replaces first script in potential exploit but not closing /script which may cause trouble, minor thing, but I wonder why not both scripts replaced: invalidTagalert('pwnd');/script

Prolly because just replacing the first one is enough to stop the browser from rendering it 🙂

but /script tag is still acting as closing script tag. if placed in unfortunate circumstances, it closes javascript block, and js code falls out to page render

FWIW, both Lucee's

<invalidTag>

(even if it replaced the closing tag) and ACF's ScriptProtect are really just partial/incomplete protection - and I believe the documentation says as much. If a user is able to inject HTML that will be rendered, then Cross Site Scripting is still possible. Full validation/encoding/sanitization of the controlled input is necessary.

Replacing Script tags is definitely not enough