diff --git a/settings/js/users.js b/settings/js/users.js
index 086b0884a3b402a33fa3a2de2de2848ebcd825a0..63a6204983931af387f192105d4edf858882d680 100644
--- a/settings/js/users.js
+++ b/settings/js/users.js
@@ -182,7 +182,7 @@ var UserList = {
 			var addGroup = function (select, group) {
 				$('select[multiple]').each(function (index, element) {
 					if ($(element).find('option[value="' + group + '"]').length === 0 && select.data('msid') !== $(element).data('msid')) {
-						$(element).append('<option value="' + group + '">' + group + '</option>');
+						$(element).append('<option value="' + escapeHTML(group) + '">' + escapeHTML(group) + '</option>');
 					}
 				})
 			};