diff --git c/core/modules/contact/lib/Drupal/contact/Controller/ContactPageController.php w/core/modules/contact/lib/Drupal/contact/Controller/ContactPageController.php
index e2bd95a..c59c484 100644
--- c/core/modules/contact/lib/Drupal/contact/Controller/ContactPageController.php
+++ w/core/modules/contact/lib/Drupal/contact/Controller/ContactPageController.php
@@ -7,14 +7,12 @@
 
 namespace Drupal\contact\Controller;
 
-use Drupal\contact\CategoryInterface;
-use Drupal\Core\Config\ConfigFactory;
-use Drupal\user\UserInterface;
 use Drupal\Core\Controller\ControllerBase;
 use Drupal\Core\DependencyInjection\ContainerInjectionInterface;
-use Drupal\Core\Entity\EntityManager;
 use Drupal\Core\Flood\FloodInterface;
-use Drupal\Core\Session\AccountInterface;
+use Drupal\contact\CategoryInterface;
+use Drupal\user\UserInterface;
+use Drupal\Component\Utility\String;
 use Symfony\Component\DependencyInjection\ContainerInterface;
 use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
@@ -32,29 +30,13 @@ class ContactPageController extends ControllerBase implements ContainerInjection
   protected $flood;
 
   /**
-   * The current active user.
-   *
-   * @var \Drupal\Core\Session\AccountInterface
-   */
-  protected $currentUser;
-
-  /**
    * Constructs a ContactController object.
    *
    * @param \Drupal\Core\Flood\FloodInterface $flood
    *   The flood service.
-   * @param \Drupal\Core\Config\ConfigFactory $config
-   *   The configuration factory.
-   * @param \Drupal\Core\Entity\EntityManager
-   *   The entity manager service.
-   * @param \Drupal\Core\Session\AccountInterface $current_user
-   *   The current account service.
    */
-  public function __construct(FloodInterface $flood, ConfigFactory $config, EntityManager $entity_manager, AccountInterface $current_user) {
+  public function __construct(FloodInterface $flood) {
     $this->flood = $flood;
-    $this->configFactory = $config;
-    $this->entityManager = $entity_manager;
-    $this->currentUser = $current_user;
   }
 
   /**
@@ -62,10 +44,7 @@ public function __construct(FloodInterface $flood, ConfigFactory $config, Entity
    */
   public static function create(ContainerInterface $container) {
     return new static(
-      $container->get('flood'),
-      $container->get('config.factory'),
-      $container->get('entity.manager'),
-      $container->get('current_user')
+      $container->get('flood')
     );
   }
 
@@ -84,7 +63,7 @@ public static function create(ContainerInterface $container) {
    */
   public function contactSitePage(CategoryInterface $contact_category = NULL) {
     // Check if flood control has been activated for sending e-mails.
-    if (!$this->currentUser->hasPermission('administer contact forms')) {
+    if (!$this->currentUser()->hasPermission('administer contact forms')) {
       $this->contactFloodControl();
     }
 
@@ -92,10 +71,10 @@ public function contactSitePage(CategoryInterface $contact_category = NULL) {
     if (empty($contact_category)) {
       $contact_category = $this->entityManager()
         ->getStorageController('contact_category')
-        ->load($this->configFactory->get('contact.settings')->get('default_category'));
+        ->load($this->config('contact.settings')->get('default_category'));
       // If there are no categories, do not display the form.
       if (empty($contact_category)) {
-        if ($this->currentUser->hasPermission('administer contact forms')) {
+        if ($this->currentUser()->hasPermission('administer contact forms')) {
           drupal_set_message($this->t('The contact form has not been configured. <a href="@add">Add one or more categories</a> to the form.', array(
             '@add' => $this->urlGenerator()->generateFromRoute('contact_category_add'))), 'error');
           return array();
@@ -113,7 +92,7 @@ public function contactSitePage(CategoryInterface $contact_category = NULL) {
       ));
 
     $form = $this->entityManager()->getForm($message);
-    $form['#title'] = $contact_category->label();
+    $form['#title'] = String::checkPlain($contact_category->label());
     return $form;
   }
 
@@ -128,7 +107,7 @@ public function contactSitePage(CategoryInterface $contact_category = NULL) {
    */
   public function contactPersonalPage(UserInterface $user) {
     // Check if flood control has been activated for sending e-mails.
-    if (!$this->currentUser->hasPermission('administer contact forms') && !$this->currentUser->hasPermission('administer users')) {
+    if (!$this->currentUser()->hasPermission('administer contact forms') && !$this->currentUser()->hasPermission('administer users')) {
       $this->contactFloodControl();
     }
 
@@ -148,8 +127,8 @@ public function contactPersonalPage(UserInterface $user) {
    * @throws \Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException
    */
   protected function contactFloodControl() {
-    $limit = $this->configFactory->get('contact.settings')->get('flood.limit');
-    $interval = $this->configFactory->get('contact.settings')->get('flood.interval');
+    $limit = $this->config('contact.settings')->get('flood.limit');
+    $interval = $this->config('contact.settings')->get('flood.interval');
     if (!$this->flood->isAllowed('contact', $limit, $interval)) {
       drupal_set_message($this->t('You cannot send more than %limit messages in @interval. Try again later.', array(
         '%limit' => $limit,