Even when I add this app setting in my web.config it doesn't work.
<add key="CMSForbiddenURLValues" value="\\/:*?\"<>|&%.'#[] =" />
Note: I found the default value for this app setting on this page
http://devnet.kentico.com/FAQs/General.aspx#FAQ272I had to change it by escaping invalid XML attribute characters so as not to cause a server error.
When I am using a route url alias, everything works fine when I use a space in the URL, but it gives me a 404 error when I use a + plus sign every time. In fact, it worked with spaces in the URL even when space characters were included in teh CMSForbiddenURLValues. I really think this issue is deeper than what you think.