diff --git a/program/include/main.inc b/program/include/main.inc
index fb9d35081..f0df4ef65 100644
--- a/program/include/main.inc
+++ b/program/include/main.inc
@@ -565,7 +565,7 @@ function rcube_xml_command($command, $str_attrib, $a_attrib=NULL)
     // show a label
     case 'label':
       if ($attrib['name'] || $attrib['command'])
-        return rcube_label($attrib);
+        return rep_specialchars_output(rcube_label($attrib));
       break;
 
     // create a menu item