diff --git a/ChangeLog b/ChangeLog
index 54120c2053..941a059ada 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -3,6 +3,7 @@ phpMyAdmin - ChangeLog
 
 4.2.7.1 (2014-08-17)
 - bug #4501 [security] XSS in table browse page
+- bug #4502 [security] Self-XSS in enum value editor
 - bug #4505 [security] XSS in view operations page
 
 4.2.7.0 (2014-07-31)
diff --git a/js/functions.js b/js/functions.js
index a970a81584..bcdead8e17 100644
--- a/js/functions.js
+++ b/js/functions.js
@@ -2692,7 +2692,7 @@ AJAX.registerOnload('functions.js', function () {
         } else {
             title = PMA_messages.enum_columnVals.replace(
                 /%s/,
-                '"' + decodeURIComponent(colname) + '"'
+                '"' + escapeHtml(decodeURIComponent(colname)) + '"'
             );
         }
         // Get the values as a string