Log in as an admin. If there are no users on your site create one. Click on the message icon in the top-right. Click on 'See all'. Click on the 'Contacts' tab. Search for another user on the site. Click on their name. CONFIRM sending plain text messages works as before (appears under the recipients name as the most recent message, and appears in the message conversation area). Send the following string as a message, and CONFIRM no alert popup is triggered in the browser: &lt;script&gt;alert( 'Test alert' );&lt;/script&gt; The message should display in the same places as step 2. Note that in the message it will display encoded as <script>alert('Test alert');</script> , rather than verbatim what was sent, but this is unrelated to this issue/fix.