diff --git a/lib/Form/Block/Base.php b/lib/Form/Block/Base.php
index 32fb7ce202..78be7c6f52 100644
--- a/lib/Form/Block/Base.php
+++ b/lib/Form/Block/Base.php
@@ -76,7 +76,7 @@ abstract class Base {
     if (isset($block['params']['label'])
       && strlen(trim($block['params']['label'])) > 0) {
       $html .= '<label class="mailpoet_'.$block['type'].'_label">';
-      $html .= $block['params']['label'];
+      $html .= htmlspecialchars($block['params']['label']);
 
       if (isset($block['params']['required']) && $block['params']['required']) {
         $html .= ' <span class="mailpoet_required">*</span>';
diff --git a/views/form/editor.html b/views/form/editor.html
index b408efa43b..2472005cd3 100644
--- a/views/form/editor.html
+++ b/views/form/editor.html
@@ -216,6 +216,9 @@
   )%>
 
   <script type="text/javascript">
+    function encodeHtmlValue(str) {
+      return str.replace(/&/g, '&amp;').replace(/>/g, '&gt;').replace(/</g, '&lt;').replace(/"/g, '&quot;');
+    }
     var mailpoet_segments = <%= json_encode(segments) %>;
 
     var mailpoet_default_fields = [
@@ -658,7 +661,7 @@
 
               mailpoet_form_fields();
               MailPoet.Notice.success(
-                "<%= __('Removed custom field %$1s') | escape('js') %>".replace('%$1s', '"' + name + '"')
+                "<%= __('Removed custom field %$1s') | escape('js') %>".replace('%$1s', '"' + encodeHtmlValue(name) + '"')
               );
 
               MailPoet.trackEvent('Forms > Delete custom field', {
diff --git a/views/form/templates/settings/field_form.hbs b/views/form/templates/settings/field_form.hbs
index d3e1da006a..279de41a96 100644
--- a/views/form/templates/settings/field_form.hbs
+++ b/views/form/templates/settings/field_form.hbs
@@ -96,11 +96,11 @@
 
           if(data.id) {
             MailPoet.Notice.success(
-              "<%= __('Updated custom field %$1s') | escape('js') %>".replace('%$1s', '"' + data.name + '"')
+              "<%= __('Updated custom field %$1s') | escape('js') %>".replace('%$1s', '"' + encodeHtmlValue(data.name) + '"')
             );
           } else {
             MailPoet.Notice.success(
-              "<%= __('Added custom field %$1s') | escape('js') %>".replace('%$1s', '"' + data.name + '"')
+              "<%= __('Added custom field %$1s') | escape('js') %>".replace('%$1s', '"' + encodeHtmlValue(data.name) + '"')
             );
           }
         }).fail(function(response) {