diff --git a/grade/report/user/classes/external/user.php b/grade/report/user/classes/external/user.php
index 650a0b18794..2a843347275 100644
--- a/grade/report/user/classes/external/user.php
+++ b/grade/report/user/classes/external/user.php
@@ -508,7 +508,7 @@ class user extends external_api {
                                 new external_single_structure(
                                     [
                                         'id' => new external_value(PARAM_INT, 'Grade item id'),
-                                        'itemname' => new external_value(PARAM_TEXT, 'Grade item name'),
+                                        'itemname' => new external_value(PARAM_CLEANHTML, 'Grade item name'),
                                         'itemtype' => new external_value(PARAM_ALPHA, 'Grade item type'),
                                         'itemmodule' => new external_value(PARAM_PLUGIN, 'Grade item module'),
                                         'iteminstance' => new external_value(PARAM_INT, 'Grade item instance'),
diff --git a/grade/upgrade.txt b/grade/upgrade.txt
index c51175a4936..49e4603f227 100644
--- a/grade/upgrade.txt
+++ b/grade/upgrade.txt
@@ -1,6 +1,10 @@
 This file describes API changes in /grade/* ;
 Information provided here is intended especially for developers.
 
+=== 4.1.6 ===
+* The grade `itemname` property contained in the return structure of the following external methods is now PARAM_CLEANHTML:
+  - `gradereport_user_get_grade_items`
+
 === 4.1 ===
 * The $importactiveurl parameter in the constructor of the core_grades\output\import_action_bar class has been deprecated and is not used anymore.
 * The $exportactiveurl parameter in the constructor of the core_grades\output\export_action_bar class has been deprecated and is not used anymore.