diff --git a/jspwiki-main/src/main/java/org/apache/wiki/plugin/WeblogPlugin.java b/jspwiki-main/src/main/java/org/apache/wiki/plugin/WeblogPlugin.java
index af882aee71..3979b6f39b 100644
--- a/jspwiki-main/src/main/java/org/apache/wiki/plugin/WeblogPlugin.java
+++ b/jspwiki-main/src/main/java/org/apache/wiki/plugin/WeblogPlugin.java
@@ -304,7 +304,7 @@ private void addEntryHTML( final Context context, final DateFormat entryFormat,
         buffer.append("<div class=\"weblogentryheading\">\n");
 
         final Date entryDate = entry.getLastModified();
-        buffer.append( entryFormat != null ? entryFormat.format(entryDate) : entryDate );
+        buffer.append( entryFormat != null ? TextUtil.replaceEntities( entryFormat.format(entryDate) ) : entryDate );
         buffer.append("</div>\n");
 
         //
diff --git a/jspwiki-main/src/test/java/org/apache/wiki/plugin/WeblogPluginTest.java b/jspwiki-main/src/test/java/org/apache/wiki/plugin/WeblogPluginTest.java
index 01d53bcc75..02ad4cb6de 100644
--- a/jspwiki-main/src/test/java/org/apache/wiki/plugin/WeblogPluginTest.java
+++ b/jspwiki-main/src/test/java/org/apache/wiki/plugin/WeblogPluginTest.java
@@ -82,4 +82,17 @@ public void testWeblogEntriesWithPreviewAndTrimming() throws WikiException {
         Assertions.assertTrue( res.contains( "<div class=\"weblogentrybody\">\nAnother blog entry  <a href=\"/test/Wiki.jsp?page="+ blogEntryPage + "\">(more)</a>\n</div>\n" ), res );
     }
 
+    @Test
+    public void testEntryFormatIsEscaped() throws WikiException {
+        final WeblogEntryPlugin wep = new WeblogEntryPlugin();
+        testEngine.saveText( wep.getNewEntryPage( testEngine, "Test5" ), "Blog entry" );
+        // A SimpleDateFormat quoted literal in an author-supplied entryFormat must not be emitted as raw markup.
+        final String src = "[{WeblogPlugin days='90' entryFormat=\"'<script>alert(document.cookie)</script>'\"}]";
+        testEngine.saveText( "Test5", src );
+
+        final String res = testEngine.getI18nHTML( "Test5" );
+        Assertions.assertFalse( res.contains( "<script>" ), res );
+        Assertions.assertFalse( res.contains( "<script>alert(document.cookie)</script>" ), res );
+    }
+
 }