diff --git a/modules/system/system.admin.inc b/modules/system/system.admin.inc
index 0f525c6..bafdf6d 100644
--- a/modules/system/system.admin.inc
+++ b/modules/system/system.admin.inc
@@ -2202,7 +2202,7 @@ function system_add_date_format_type_form_submit($form, &$form_state) {
  * Return the date for a given format string via Ajax.
  */
 function system_date_time_lookup() {
-  $result = format_date(REQUEST_TIME, 'custom', $_GET['format']);
+  $result = filter_xss_admin(format_date(REQUEST_TIME, 'custom', $_GET['format']));
   drupal_json_output($result);
 }
 
@@ -2854,7 +2854,7 @@ function system_date_time_formats() {
   if (!empty($formats)) {
     foreach ($formats as $format) {
       $row = array();
-      $row[] = array('data' => format_date(REQUEST_TIME, 'custom', $format['format']));
+      $row[] = array('data' => filter_xss_admin(format_date(REQUEST_TIME, 'custom', $format['format'])));
       $row[] = array('data' => l(t('edit'), 'admin/config/regional/date-time/formats/' . $format['dfid'] . '/edit'));
       $row[] = array('data' => l(t('delete'), 'admin/config/regional/date-time/formats/' . $format['dfid'] . '/delete'));
       $rows[] = $row;