Manually escape related posts

templates/_includes/related_posts.html

@@ -4,13 +4,13 @@
     <h2>{{ RELATED_POSTS_LABEL }}</h2>
 <ul class="related-posts-list">
 {% for related_post in article.related_posts|sort(attribute = 'date') %}
-    {% set title = related_post.title|striptags %}
-    {% set htitle = title %}
+    {% set v_title = related_post.title|striptags %}
+    {% set title = related_post.title|striptags|e %}
     {%if related_post.subtitle %}
-        {% set htitle = title + ' - ' + related_post.subtitle %}
-        {% set title = title + ' ' +  '<small>' + related_post.subtitle + '</small>' %}
+        {% set title = title + ' - ' + related_post.subtitle|striptags|e %}
+        {% set v_title = v_title + ' ' +  '<small>' + related_post.subtitle|striptags + '</small>' %}
     {% endif %}
-<li><a href="{{ SITEURL }}/{{ related_post.url }}" title="{{ htitle }}">{{ title }}</a></li>
+<li><a href="{{ SITEURL }}/{{ related_post.url }}" title="{{ title }}">{{ v_title }}</a></li>
 {% endfor %}
 </ul>
 <hr />