diff --git a/ChangeLog b/ChangeLog
index 94b41b5d26..eea09d6158 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,6 +5,7 @@ phpMyAdmin - ChangeLog
 - bug #4501 [security] XSS in table browse page
 - bug #4502 [security] Self-XSS in enum value editor
 - bug #4503 [security] Self-XSSes in monitor
+- bug #4504 [security] Self-XSS in query charts
 - bug #4505 [security] XSS in view operations page
 
 4.2.7.0 (2014-07-31)
diff --git a/js/tbl_chart.js b/js/tbl_chart.js
index 943d4aee35..04c9c40b0c 100644
--- a/js/tbl_chart.js
+++ b/js/tbl_chart.js
@@ -47,7 +47,7 @@ function PMA_queryChart(data, columnNames, settings) {
         },
         axes : {
             xaxis : {
-                label : settings.xaxisLabel
+                label : escapeHtml(settings.xaxisLabel)
             },
             yaxis : {
                 label : settings.yaxisLabel