Even if we assume that your filters work perfectly (which I would not do automatically, filtering is rather complex, and easy to get wrong), this may lead to XSS.
Because it hasn't been mentioned yet:
a in combination with an unfiltered
The victim has to actually click the link, but an attacker can provide an interesting link or use ClickJacking to achieve this.
Because you mentioned in a comment that you do not use any encoding, but just tag filtering: If you do not encode quotes, an attacker can break out of the context of the current attribute. For example:
user_input = invalid" onerror="alert(1)
<img src="invalid" onerror="alert(1)">
which will be executed by all browsers.