diff --git a/core/modules/field/field.api.php b/core/modules/field/field.api.php
index b4f0198..43c0ef2 100644
--- a/core/modules/field/field.api.php
+++ b/core/modules/field/field.api.php
@@ -29,7 +29,8 @@
  *   'display'). The keys are the name of the elements as appearing in the
  *   renderable array (either the entity form or the displayed entity). The
  *   value is an associative array:
- *   - label: The human readable name of the element.
+ *   - label: The human readable name of the element. Make sure you sanitize
+ *     this appropriately.
  *   - description: A short description of the element contents.
  *   - weight: The default weight of the element.
  *   - visible: (optional) The default visibility of the element. Defaults to
@@ -49,7 +50,7 @@ function hook_field_extra_fields() {
   foreach (node_type_get_types() as $bundle) {
     if ($bundle->has_title) {
       $extra['node'][$bundle->type]['form']['title'] = array(
-        'label' => $bundle->title_label,
+        'label' => check_plain($bundle->title_label),
         'description' => $description,
         'weight' => -5,
       );
diff --git a/core/modules/field_ui/lib/Drupal/field_ui/DisplayOverviewBase.php b/core/modules/field_ui/lib/Drupal/field_ui/DisplayOverviewBase.php
index fcc764c..f4dfc8a 100644
--- a/core/modules/field_ui/lib/Drupal/field_ui/DisplayOverviewBase.php
+++ b/core/modules/field_ui/lib/Drupal/field_ui/DisplayOverviewBase.php
@@ -398,7 +398,7 @@ protected function buildExtraFieldRow($field_id, $extra_field, $entity_display)
       '#region_callback' => array($this, 'getRowRegion'),
       '#js_settings' => array('rowHandler' => 'field'),
       'human_name' => array(
-        '#markup' => check_plain($extra_field['label']),
+        '#markup' => $extra_field['label'],
       ),
       'weight' => array(
         '#type' => 'textfield',
diff --git a/core/modules/node/node.module b/core/modules/node/node.module
index 4fe1645..c91c575 100644
--- a/core/modules/node/node.module
+++ b/core/modules/node/node.module
@@ -449,7 +449,7 @@ function node_field_extra_fields() {
   foreach (node_type_get_types() as $bundle) {
     if ($bundle->has_title) {
       $extra['node'][$bundle->type]['form']['title'] = array(
-        'label' => $bundle->title_label,
+        'label' => check_plain($bundle->title_label),
         'description' => $description,
         'weight' => -5,
       );