diff --git a/client/src/views/dashlets/options/base.js b/client/src/views/dashlets/options/base.js
index 7bcff63f72..667f2c47b4 100644
--- a/client/src/views/dashlets/options/base.js
+++ b/client/src/views/dashlets/options/base.js
@@ -120,7 +120,9 @@ Espo.define('views/dashlets/options/base', ['views/modal', 'views/record/detail'
                 }
             });
 
-            this.header = this.getLanguage().translate('Dashlet Options') + ': ' + this.getLanguage().translate(this.name, 'dashlets');
+            this.header =
+                this.getLanguage().translate('Dashlet Options') + ': ' +
+                Handlebars.Utils.escapeExpression(this.getLanguage().translate(this.name, 'dashlets'));
         },
 
         setupBeforeFinal: function () {},
diff --git a/client/src/views/email/modals/body-plain.js b/client/src/views/email/modals/body-plain.js
index d5e2ad13fb..2c95c14871 100644
--- a/client/src/views/email/modals/body-plain.js
+++ b/client/src/views/email/modals/body-plain.js
@@ -41,7 +41,7 @@ Espo.define('views/email/modals/body-plain', 'views/modal', function (Dep) {
                 'label': 'Close'
             });
 
-            this.header = this.model.get('name');
+            this.header = Handlebars.Utils.escapeExpression(this.model.get('name'));
 
             this.createView('bodyPlain', 'views/fields/text', {
                 el: this.options.el + ' .field[data-name="bodyPlain"]',