diff --git a/modules/system/controllers/updates/_plugin_form.htm b/modules/system/controllers/updates/_plugin_form.htm
index 03fb6c602..9b6108d3b 100644
--- a/modules/system/controllers/updates/_plugin_form.htm
+++ b/modules/system/controllers/updates/_plugin_form.htm
@@ -6,7 +6,7 @@
     <div class="modal-body">
 
         <?php if ($this->fatalError): ?>
-            <p class="flash-message static error"><?= $fatalError ?></p>
+            <p class="flash-message static error"><?= e($fatalError) ?></p>
         <?php endif ?>
 
         <div class="form-group">
@@ -16,7 +16,7 @@
                 type="text"
                 class="form-control"
                 id="pluginCode"
-                value="<?= post('code') ?>" />
+                value="<?= e(post('code')) ?>" />
             <p class="help-block"><?= e(trans('system::lang.plugin.name.help')) ?></p>
         </div>
 
diff --git a/modules/system/controllers/updates/_project_form.htm b/modules/system/controllers/updates/_project_form.htm
index f56135a74..3a133b817 100644
--- a/modules/system/controllers/updates/_project_form.htm
+++ b/modules/system/controllers/updates/_project_form.htm
@@ -6,7 +6,7 @@
     <div class="modal-body">
 
         <?php if ($this->fatalError): ?>
-            <p class="flash-message static error"><?= $fatalError ?></p>
+            <p class="flash-message static error"><?= e($fatalError) ?></p>
         <?php endif ?>
 
         <div class="form-group">
diff --git a/modules/system/controllers/updates/_theme_form.htm b/modules/system/controllers/updates/_theme_form.htm
index 8729e8974..e13239cca 100644
--- a/modules/system/controllers/updates/_theme_form.htm
+++ b/modules/system/controllers/updates/_theme_form.htm
@@ -6,7 +6,7 @@
     <div class="modal-body">
 
         <?php if ($this->fatalError): ?>
-            <p class="flash-message static error"><?= $fatalError ?></p>
+            <p class="flash-message static error"><?= e($fatalError) ?></p>
         <?php endif ?>
 
         <div class="form-group">
@@ -16,7 +16,7 @@
                 type="text"
                 class="form-control"
                 id="themeCode"
-                value="<?= post('code') ?>" />
+                value="<?= e(post('code')) ?>" />
             <p class="help-block"><?= e(trans('system::lang.theme.name.help')) ?></p>
         </div>