diff --git a/ChangeLog b/ChangeLog
index a2027bb1aa..5d7ed24ea7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -39,6 +39,14 @@ phpMyAdmin - ChangeLog
 4.2.8.0 (not yet released)
 - bug #4516 Odd export behavior
 
+4.2.7.1 (2014-08-17)
+- bug #4501 [security] XSS in table browse page
+- bug #4502 [security] Self-XSS in enum value editor
+- bug #4503 [security] Self-XSSes in monitor
+- bug #4504 [security] Self-XSS in query charts
+- bug #4505 [security] XSS in view operations page
+- bug #4517 [security] XSS in relation view
+
 4.2.7.0 (2014-07-31)
 - bug       Broken links on home page
 - bug #4494 Overlap in navigation panel
diff --git a/js/functions.js b/js/functions.js
index ff9a321bba..5faee529cc 100644
--- a/js/functions.js
+++ b/js/functions.js
@@ -2842,7 +2842,7 @@ AJAX.registerOnload('functions.js', function () {
         } else {
             title = PMA_messages.enum_columnVals.replace(
                 /%s/,
-                '"' + decodeURIComponent(colname) + '"'
+                '"' + escapeHtml(decodeURIComponent(colname)) + '"'
             );
         }
         // Get the values as a string
@@ -3870,7 +3870,7 @@ AJAX.registerOnload('functions.js', function () {
         var question = PMA_messages.strDropTableStrongWarning + ' ';
         question += $.sprintf(
             PMA_messages.strDoYouReally,
-            'DROP VIEW ' + PMA_commonParams.get('table')
+            'DROP VIEW ' + escapeHtml(PMA_commonParams.get('table'))
         );
 
         $(this).PMA_confirm(question, $(this).attr('href'), function (url) {
diff --git a/js/server_status_monitor.js b/js/server_status_monitor.js
index 60ab1ff5a0..24274a3d07 100644
--- a/js/server_status_monitor.js
+++ b/js/server_status_monitor.js
@@ -913,7 +913,7 @@ AJAX.registerOnload('server_status_monitor.js', function () {
             label: $('#variableInput').val().replace(/_/g, " ")
         };
         newChart.series.push(newSeries);
-        $('#seriesPreview').append('- ' + newSeries.label + str + '<br/>');
+        $('#seriesPreview').append('- ' + escapeHtml(newSeries.label + str) + '<br/>');
         newChart.nodes.push(serie);
         $('#variableInput').val('');
         $('input[name="differentialValue"]').prop('checked', true);
diff --git a/js/sql.js b/js/sql.js
index 012a69f66b..15f414e797 100644
--- a/js/sql.js
+++ b/js/sql.js
@@ -121,7 +121,7 @@ AJAX.registerOnload('sql.js', function () {
     // Delete row from SQL results
     $('a.delete_row.ajax').live('click', function (e) {
         e.preventDefault();
-        var question = $.sprintf(PMA_messages.strDoYouReally, $(this).closest('td').find('div').text());
+        var question = $.sprintf(PMA_messages.strDoYouReally, escapeHtml($(this).closest('td').find('div').text()));
         var $link = $(this);
         $link.PMA_confirm(question, $link.attr('href'), function (url) {
             $msgbox = PMA_ajaxShowMessage();
diff --git a/js/tbl_chart.js b/js/tbl_chart.js
index 37e5d90325..1dafa0f5d0 100644
--- a/js/tbl_chart.js
+++ b/js/tbl_chart.js
@@ -47,7 +47,7 @@ function PMA_queryChart(data, columnNames, settings) {
         },
         axes : {
             xaxis : {
-                label : settings.xaxisLabel
+                label : escapeHtml(settings.xaxisLabel)
             },
             yaxis : {
                 label : settings.yaxisLabel