diff --git a/lib/form/filemanager.js b/lib/form/filemanager.js
index 9e825e39921..3686c8b8df3 100644
--- a/lib/form/filemanager.js
+++ b/lib/form/filemanager.js
@@ -251,7 +251,7 @@ M.form_filemanager.init = function(Y, options) {
 
             this.msg_dlg.set('headerContent', header);
             this.msg_dlg_node.removeClass('fp-msg-info').removeClass('fp-msg-error').addClass('fp-msg-'+type)
-            this.msg_dlg_node.one('.fp-msg-text').setContent(msg);
+            this.msg_dlg_node.one('.fp-msg-text').setContent(Y.Escape.html(msg));
             this.msg_dlg.show();
         },
         is_disabled: function() {
@@ -322,7 +322,7 @@ M.form_filemanager.init = function(Y, options) {
                     }
                     this.mkdir_dialog.show();
                     Y.one('#fm-newname-'+scope.client_id).focus();
-                    Y.all('#fm-curpath-'+scope.client_id).setContent(this.currentpath)
+                    Y.all('#fm-curpath-'+scope.client_id).setContent(Y.Escape.html(this.currentpath))
                 }, this);
             } else {
                 this.filemanager.addClass('fm-nomkdir');
@@ -409,7 +409,7 @@ M.form_filemanager.init = function(Y, options) {
                     } else {
                         el.addClass('odd');
                     }
-                    el.one('.fp-path-folder-name').setContent(p[i].name).
+                    el.one('.fp-path-folder-name').setContent(Y.Escape.html(p[i].name)).
                         on('click', function(e, path) {
                             e.preventDefault();
                             if (!this.is_disabled()) {
@@ -599,7 +599,7 @@ M.form_filemanager.init = function(Y, options) {
             for (var i in licenses) {
                 var option = Y.Node.create('<option/>').
                     set('value', licenses[i].shortname).
-                    setContent(licenses[i].fullname);
+                    setContent(Y.Escape.html(licenses[i].fullname));
                 node.appendChild(option)
             }
         },
@@ -618,7 +618,7 @@ M.form_filemanager.init = function(Y, options) {
             node.setContent('');
             for (var i in list) {
                 node.appendChild(Y.Node.create('<option/>').
-                    set('value', list[i]).setContent(list[i]))
+                    set('value', list[i]).setContent(Y.Escape.html(list[i])));
             }
         },
         update_file: function(confirmed) {
@@ -920,7 +920,7 @@ M.form_filemanager.init = function(Y, options) {
                 if (selectnode.one('.fp-'+attrs[i])) {
                     var value = (node[attrs[i]+'_f']) ? node[attrs[i]+'_f'] : (node[attrs[i]] ? node[attrs[i]] : '');
                     selectnode.one('.fp-'+attrs[i]).addClassIf('fp-unknown', ''+value == '')
-                        .one('.fp-value').setContent(value);
+                        .one('.fp-value').setContent(Y.Escape.html(value));
                 }
             }
             // display thumbnail
@@ -945,7 +945,7 @@ M.form_filemanager.init = function(Y, options) {
                             selectnode.one('.fp-original').removeClass('fp-loading');
                             if (obj.original) {
                                 node.original = obj.original;
-                                selectnode.one('.fp-original .fp-value').setContent(node.original);
+                                selectnode.one('.fp-original .fp-value').setContent(Y.Escape.html(node.original));
                             } else {
                                 selectnode.one('.fp-original .fp-value').setContent(M.str.repository.unknownsource);
                             }
@@ -973,7 +973,7 @@ M.form_filemanager.init = function(Y, options) {
                                 for (var i in obj.references) {
                                     node.reflist += '<li>'+obj.references[i]+'</li>';
                                 }
-                                selectnode.one('.fp-reflist .fp-value').setContent(node.reflist);
+                                selectnode.one('.fp-reflist .fp-value').setContent(Y.Escape.html(node.reflist));
                             } else {
                                 selectnode.one('.fp-reflist .fp-value').setContent('');
                             }
diff --git a/lib/outputrequirementslib.php b/lib/outputrequirementslib.php
index dda9f6bf4da..e2f6176d819 100644
--- a/lib/outputrequirementslib.php
+++ b/lib/outputrequirementslib.php
@@ -450,7 +450,7 @@ class page_requirements_manager {
                 case 'core_filepicker':
                     $module = array('name'     => 'core_filepicker',
                                     'fullpath' => '/repository/filepicker.js',
-                                    'requires' => array('base', 'node', 'node-event-simulate', 'json', 'async-queue', 'io-base', 'io-upload-iframe', 'io-form', 'yui2-treeview', 'panel', 'cookie', 'datatable', 'datatable-sort', 'resize-plugin', 'dd-plugin', 'moodle-core_filepicker'),
+                                    'requires' => array('base', 'node', 'node-event-simulate', 'json', 'async-queue', 'io-base', 'io-upload-iframe', 'io-form', 'yui2-treeview', 'panel', 'cookie', 'datatable', 'datatable-sort', 'resize-plugin', 'dd-plugin', 'escape', 'moodle-core_filepicker'),
                                     'strings'  => array(array('lastmodified', 'moodle'), array('name', 'moodle'), array('type', 'repository'), array('size', 'repository'),
                                                         array('invalidjson', 'repository'), array('error', 'moodle'), array('info', 'moodle'),
                                                         array('nofilesattached', 'repository'), array('filepicker', 'repository'), array('logout', 'repository'),
diff --git a/repository/filepicker.js b/repository/filepicker.js
index 5ff517b8da6..64b1428ec92 100644
--- a/repository/filepicker.js
+++ b/repository/filepicker.js
@@ -175,15 +175,24 @@ YUI.add('moodle-core_filepicker', function(Y) {
         /** return the name of the file (different attributes in FileManager and FilePicker) */
         var file_get_filename = function(node) {
             return node.title ? node.title : node.fullname;
-        }
+        };
         /** return display name of the file (different attributes in FileManager and FilePicker) */
         var file_get_displayname = function(node) {
-            return node.shorttitle ? node.shorttitle : file_get_filename(node);
-        }
+            var displayname = node.shorttitle ? node.shorttitle : file_get_filename(node);
+            return Y.Escape.html(displayname);
+        };
         /** return file description (different attributes in FileManager and FilePicker) */
         var file_get_description = function(node) {
-            return node.description ? node.description : (node.thumbnail_title ? node.thumbnail_title : file_get_filename(node));
-        }
+            var description = '';
+            if (node.description) {
+                description = node.description;
+            } else if (node.thumbnail_title) {
+                description = node.thumbnail_title;
+            } else {
+                description = file_get_filename(node);
+            }
+            return Y.Escape.html(description);
+        };
         /** help funciton for tree view */
         var build_tree = function(node, level) {
             // prepare file name with icon
@@ -401,7 +410,7 @@ YUI.add('moodle-core_filepicker', function(Y) {
                 imgdiv.setStyleAdv('width', width).setStyleAdv('height', height);
                 var img = Y.Node.create('<img/>').setAttrs({
                         title: file_get_description(node),
-                        alt: node.thumbnail_alt ? node.thumbnail_alt : file_get_filename(node)}).
+                        alt: Y.Escape.html(node.thumbnail_alt ? node.thumbnail_alt : file_get_filename(node))}).
                     setStyle('maxWidth', ''+width+'px').
                     setStyle('maxHeight', ''+height+'px');
                 img.setImgSrc(src, node.realthumbnail, lazyloading);
@@ -736,7 +745,7 @@ M.core_filepicker.init = function(Y, options) {
             this.fpnode.one('.fp-content').setContent(M.core_filepicker.templates.error);
             this.fpnode.one('.fp-content .fp-error').
                 addClass(errorcode).
-                setContent(errortext);
+                setContent(Y.Escape.html(errortext));
         },
         /** displays message in a popup */
         print_msg: function(msg, type) {
@@ -766,7 +775,7 @@ M.core_filepicker.init = function(Y, options) {
 
             this.msg_dlg.set('headerContent', header);
             this.msg_dlg_node.removeClass('fp-msg-info').removeClass('fp-msg-error').addClass('fp-msg-'+type)
-            this.msg_dlg_node.one('.fp-msg-text').setContent(msg);
+            this.msg_dlg_node.one('.fp-msg-text').setContent(Y.Escape.html(msg));
             this.msg_dlg.show();
         },
         view_files: function(appenditems) {
@@ -1104,7 +1113,7 @@ M.core_filepicker.init = function(Y, options) {
                 if (selectnode.one('.fp-'+attrs[i])) {
                     var value = (args[attrs[i]+'_f']) ? args[attrs[i]+'_f'] : (args[attrs[i]] ? args[attrs[i]] : '');
                     selectnode.one('.fp-'+attrs[i]).addClassIf('fp-unknown', ''+value == '')
-                        .one('.fp-value').setContent(value);
+                        .one('.fp-value').setContent(Y.Escape.html(value));
                 }
             }
         },
@@ -1350,7 +1359,7 @@ M.core_filepicker.init = function(Y, options) {
                             this.hide_header();
                             this.list({'repo_id':repository_id});
                         }, this /*handler running scope*/, repository.id/*second argument of handler*/);
-                    node.one('.fp-repo-name').setContent(repository.name);
+                    node.one('.fp-repo-name').setContent(Y.Escape.html(repository.name));
                     node.one('.fp-repo-icon').set('src', repository.icon);
                     if (i==0) {
                         node.addClass('first');
@@ -1605,7 +1614,7 @@ M.core_filepicker.init = function(Y, options) {
                 var option = Y.Node.create('<option/>').
                     set('selected', (this.options.defaultlicense==licenses[i].shortname)).
                     set('value', licenses[i].shortname).
-                    setContent(licenses[i].fullname);
+                    setContent(Y.Escape.html(licenses[i].fullname));
                 node.appendChild(option)
             }
         },
@@ -1867,7 +1876,7 @@ M.core_filepicker.init = function(Y, options) {
                     } else {
                         el.addClass('odd');
                     }
-                    el.all('.fp-path-folder-name').setContent(p[i].name);
+                    el.all('.fp-path-folder-name').setContent(Y.Escape.html(p[i].name));
                     el.on('click',
                             function(e, path) {
                                 e.preventDefault();
diff --git a/repository/filepicker.php b/repository/filepicker.php
index 1b673318b1a..14cf935ec78 100644
--- a/repository/filepicker.php
+++ b/repository/filepicker.php
@@ -141,12 +141,12 @@ case 'search':
             if (isset($item['thumbnail_width'])) {
                 $style .= 'max-width:'.$item['thumbnail_width'].'px;';
             }
-            echo html_writer::empty_tag('img', array('src' => $item['thumbnail'], 'style' => $style));
+            echo html_writer::empty_tag('img', array('src' => $item['thumbnail'], 'alt' => '', 'style' => $style));
             echo '</td><td>';
             if (!empty($item['url'])) {
-                echo html_writer::link($item['url'], $item['title'], array('target'=>'_blank'));
+                echo html_writer::link($item['url'], s($item['title']), array('target'=>'_blank'));
             } else {
-                echo $item['title'];
+                echo s($item['title']);
             }
             echo '</td>';
             echo '<td>';
@@ -203,7 +203,7 @@ case 'sign':
                         'draftpath'=>$draftpath,
                         'savepath'=>$savepath
                         ));
-                    echo '<strong>' . html_writer::link($pathurl, $p['name']) . '</strong>';
+                    echo '<strong>' . html_writer::link($pathurl, s($p['name'])) . '</strong>';
                     echo '<span> / </span>';
                 }
             }
@@ -240,9 +240,9 @@ case 'sign':
                 echo html_writer::empty_tag('img', array('src' => $item['thumbnail'], 'style' => $style));
                 echo '</td><td>';
                 if (!empty($item['url'])) {
-                    echo html_writer::link($item['url'], $item['title'], array('target'=>'_blank'));
+                    echo html_writer::link($item['url'], s($item['title']), array('target'=>'_blank'));
                 } else {
-                    echo $item['title'];
+                    echo s($item['title']);
                 }
                 echo '</td>';
                 echo '<td>';
@@ -387,8 +387,8 @@ case 'plugins':
         $aurl->params(array('savepath'=>$savepath, 'action' => 'list', 'repo_id' => $info->id, 'draftpath'=>$draftpath));
 
         echo '<li>';
-        echo '<img src="'.$info->icon.'" alt="'.$info->name.'" width="16" height="16" /> ';
-        echo html_writer::link($aurl, $info->name);
+        echo html_writer::empty_tag('img', array('src'=>$info->icon, 'alt'=>$info->name, 'class'=>'icon icon-pre'));
+        echo html_writer::link($aurl, s($info->name));
         echo '</li>';
     }
     echo '</ul>';