diff --git a/erpnext/public/js/templates/crm_activities.html b/erpnext/public/js/templates/crm_activities.html
index 683f3011409..0d32e89cd94 100644
--- a/erpnext/public/js/templates/crm_activities.html
+++ b/erpnext/public/js/templates/crm_activities.html
@@ -115,7 +115,7 @@
                                     </svg>
                                 </span>
                                 <a href="/app/event/{{ frappe.utils.escape_html(events[i].name) }}" title="{{ __('Open Event') }}">
-                                    {%= events[i].subject %}
+                                    {%= frappe.utils.escape_html(events[i].subject) %}
                                 </a>
                             </div>
                             <div class="checkbox">
@@ -162,7 +162,7 @@
 							</svg>
 						</span>
 						<a href="/app/event/{{ frappe.utils.escape_html(event.name) }}" title="{{ __('Open Event') }}">
-							{%= event.subject %}
+							{%= frappe.utils.escape_html(event.subject) %}
 						</a>
 					</div>
 					<div class="checkbox">