diff --git a/views/bootstrap/class.ViewDocument.php b/views/bootstrap/class.ViewDocument.php
index c65259bae..bd6dd7e11 100644
--- a/views/bootstrap/class.ViewDocument.php
+++ b/views/bootstrap/class.ViewDocument.php
@@ -766,7 +766,7 @@ class SeedDMS_View_ViewDocument extends SeedDMS_Bootstrap_Style {
 					echo "<tr>";
 					echo "<td>".$wkflog->getWorkflow()->getName()."</td>";
 					echo "<td>".$wkflog->getDate()."</td>";
-					echo "<td>".$wkflog->getTransition()->getAction()->getName()."</td>";
+					echo "<td>".htmlspecialchars($wkflog->getTransition()->getAction()->getName())."</td>";
 					$loguser = $wkflog->getUser();
 					echo "<td>".htmlspecialchars($loguser->getFullName())."</td>";
 					echo "<td>".htmlspecialchars($wkflog->getComment())."</td>";
@@ -1043,14 +1043,14 @@ class SeedDMS_View_ViewDocument extends SeedDMS_Bootstrap_Style {
 			foreach($transitions as $transition) {
 				$nextstate = $transition->getNextState();
 				$docstatus = $nextstate->getDocumentStatus();
-				echo "<td><i class=\"icon-circle".($docstatus == S_RELEASED ? " released" : ($docstatus == S_REJECTED ? " rejected" : " in-workflow"))."\"></i> ".$nextstate->getName()."</td>";
+				echo "<td><i class=\"icon-circle".($docstatus == S_RELEASED ? " released" : ($docstatus == S_REJECTED ? " rejected" : " in-workflow"))."\"></i> ".htmlspecialchars($nextstate->getName())."</td>";
 			}
 			echo "</tr>";
 			echo "<tr>";
 			echo "<td>".getMLText('action').":</td>";
 			foreach($transitions as $transition) {
 				$action = $transition->getAction();
-				echo "<td>".getMLText('action_'.strtolower($action->getName()), array(), $action->getName())."</td>";
+				echo "<td>".getMLText('action_'.strtolower($action->getName()), array(), htmlspecialchars($action->getName()))."</td>";
 			}
 			echo "</tr>";
 			echo "<tr>";