diff --git a/core/modules/contact/src/ContactFormListBuilder.php b/core/modules/contact/src/ContactFormListBuilder.php
index 5a2b6b0..4ba3b36 100644
--- a/core/modules/contact/src/ContactFormListBuilder.php
+++ b/core/modules/contact/src/ContactFormListBuilder.php
@@ -41,7 +41,11 @@ public function buildRow(EntityInterface $entity) {
     }
     else {
       $row['form'] = $entity->link(NULL, 'canonical');
-      $row['recipients'] = SafeMarkup::checkPlain(implode(', ', $entity->getRecipients()));
+      $row['recipients']['data'] = [
+        '#theme' => 'item_list',
+        '#items' => $entity->getRecipients(),
+        '#context' => ['list_style' => 'comma-list'],
+      ];
       $default_form = \Drupal::config('contact.settings')->get('default_form');
       $row['selected'] = ($default_form == $entity->id() ? t('Yes') : t('No'));
     }
diff --git a/core/modules/contact/src/Tests/ContactSitewideTest.php b/core/modules/contact/src/Tests/ContactSitewideTest.php
index 87d693a..1ab942b 100644
--- a/core/modules/contact/src/Tests/ContactSitewideTest.php
+++ b/core/modules/contact/src/Tests/ContactSitewideTest.php
@@ -124,7 +124,7 @@ function testSiteWideContact() {
     $this->assertText(t('Recipients field is required.'));
 
     // Test validation of max_length machine name.
-    $recipients = array('simpletest@example.com', 'simpletest2@example.com', 'simpletest3@example.com');
+    $recipients = array('simpletest&@example.com', 'simpletest2@example.com', 'simpletest3@example.com');
     $max_length = EntityTypeInterface::BUNDLE_MAX_LENGTH;
     $max_length_exceeded = $max_length + 1;
     $this->addContactForm($id = Unicode::strtolower($this->randomMachineName($max_length_exceeded)), $label = $this->randomMachineName($max_length_exceeded), implode(',', array($recipients[0])), '', TRUE);
@@ -144,6 +144,10 @@ function testSiteWideContact() {
     // Make sure the newly created form is included in the list of forms.
     $this->assertNoUniqueText($label, 'New form included in forms list.');
 
+    // Ensure that the recipient email is escaped on the listing.
+    $this->drupalGet('admin/structure/contact');
+    $this->assertEscaped($recipients[0]);
+
     // Test update contact form.
     $this->updateContactForm($id, $label = $this->randomMachineName(16), $recipients_str = implode(',', array($recipients[0], $recipients[1])), $reply = $this->randomMachineName(30), FALSE);
     $config = $this->config('contact.form.' . $id)->get();