diff --git a/ChangeLog b/ChangeLog
index 704414f1ca..a088d15dbc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,6 +4,7 @@ phpMyAdmin - ChangeLog
 4.0.10.1 (Not yet released)
 - bug #4501 [security] XSS in table browse page
 - bug #4502 [security] Self-XSS in enum value editor
+- bug #4503 [security] Self-XSSes in monitor
 
 4.0.10.1 (2014-07-17)
 - bug #4488 [security] XSS injection due to unescaped table name (triggers)
diff --git a/js/server_status_monitor.js b/js/server_status_monitor.js
index dc97ec0729..c9f86e79f7 100644
--- a/js/server_status_monitor.js
+++ b/js/server_status_monitor.js
@@ -996,7 +996,7 @@ AJAX.registerOnload('server_status_monitor.js', function() {
             label: $('#variableInput').val().replace(/_/g, " ")
         };
         newChart.series.push(newSeries);
-        $('#seriesPreview').append('- ' + newSeries.label + str + '<br/>');
+        $('#seriesPreview').append('- ' + escapeHtml(newSeries.label + str) + '<br/>');
         newChart.nodes.push(serie);
         $('#variableInput').val('');
         $('input[name="differentialValue"]').prop('checked', true);