diff --git a/core/modules/taxonomy/lib/Drupal/taxonomy/Tests/VocabularyTest.php b/core/modules/taxonomy/lib/Drupal/taxonomy/Tests/VocabularyTest.php
index d63f176..daed3f7 100644
--- a/core/modules/taxonomy/lib/Drupal/taxonomy/Tests/VocabularyTest.php
+++ b/core/modules/taxonomy/lib/Drupal/taxonomy/Tests/VocabularyTest.php
@@ -63,6 +63,17 @@ class VocabularyTest extends TaxonomyTestBase {
     $edit['machine_name'] = '!&^%';
     $this->drupalPost('admin/structure/taxonomy/add', $edit, t('Save'));
     $this->assertText(t('The machine-readable name must contain only lowercase letters, numbers, and underscores.'));
+
+    // Ensure that vocabulary titles are escaped properly.
+    $edit = array();
+    $edit['name'] = 'Don\'t Panic';
+    $edit['description'] = $this->randomName();
+    $edit['machine_name'] = 'don_t_panic';
+    $this->drupalPost('admin/structure/taxonomy/add', $edit, t('Save'));
+
+    $site_name = config('system.site')->get('name');
+    $this->assertTitle(t('Don\'t Panic | @site-name', array('@site-name' => $site_name)));
+    $this->assertNoTitle(t('Don't Panic | @site-name', array('@site-name' => $site_name)));
   }
 
   /**
diff --git a/core/modules/taxonomy/taxonomy.module b/core/modules/taxonomy/taxonomy.module
index f55ac1d..e102bab 100644
--- a/core/modules/taxonomy/taxonomy.module
+++ b/core/modules/taxonomy/taxonomy.module
@@ -429,7 +429,7 @@ function taxonomy_term_access($op, $term) {
  * Return the vocabulary name given the vocabulary object.
  */
 function taxonomy_admin_vocabulary_title_callback(Vocabulary $vocabulary) {
-  return $vocabulary->name;
+  return check_plain($vocabulary->name);
 }
 
 /**