diff --git a/core/lib/Drupal/Component/Utility/SafeMarkup.php b/core/lib/Drupal/Component/Utility/SafeMarkup.php
index b4e0989..92a082e 100644
--- a/core/lib/Drupal/Component/Utility/SafeMarkup.php
+++ b/core/lib/Drupal/Component/Utility/SafeMarkup.php
@@ -7,6 +7,8 @@
 
 namespace Drupal\Component\Utility;
 
+use Drupal\Component\Utility\Xss;
+
 /**
  * Manages known safe strings for rendering at the theme layer.
  *
@@ -15,9 +17,9 @@
  * provides a store for known safe strings and methods to manage them
  * throughout the page request.
  *
- * Strings sanitized by self::checkPlain() and self::escape() are automatically
- * marked safe, as are markup strings created from @link theme_render render
- * arrays @endlink via drupal_render().
+ * Strings sanitized by self::checkPlain(), self::escape() and self::format()
+ * are automatically marked safe, as are markup strings created from
+ * @link theme_render render arrays @endlink via drupal_render().
  *
  * This class should be limited to internal use only. Module developers should
  * instead use the appropriate
@@ -205,25 +207,24 @@ public static function checkPlain($text) {
    *     @code
    *       <em class="placeholder">text output here.</em>
    *     @endcode
-   *   - !variable: Inserted as is, with no sanitization or formatting. Only
+   *   - !variable: If the string is safe, it will be inserted as is, with no
+   *     sanitization or formatting. If the string is unsafe, a very permissive
+   *     XSS/HTML filter for admin-only use will be applied. Only
    *     use this when the resulting string is being generated for one of:
    *     - Non-HTML usage, such as a plain-text email.
    *     - Non-direct HTML output, such as a plain-text variable that will be
    *       printed as an HTML attribute value and therefore formatted with
    *       self::checkPlain() as part of that.
-   *     - Some other special reason for suppressing sanitization.
+   *     - Some other special reason for suppressing HTML escaping.
    *
    * @return string
-   *   The formatted string, which is marked as safe unless sanitization of an
-   *   unsafe argument was suppressed (see above).
+   *   The formatted string, which is marked as safe.
    *
    * @ingroup sanitization
    *
    * @see t()
    */
   public static function format($string, array $args) {
-    $safe = TRUE;
-
     // Transform arguments before inserting them.
     foreach ($args as $key => $value) {
       switch ($key[0]) {
@@ -239,17 +240,17 @@ public static function format($string, array $args) {
           break;
 
         case '!':
-          // Pass-through.
+          // Try to preserve the value by only admin filtering if not marked
+          // safe.
           if (!static::isSafe($value)) {
-            $safe = FALSE;
+            // XSS admin filtered.
+            $args[$key] = Xss::filterAdmin($value);
           }
       }
     }
 
     $output = strtr($string, $args);
-    if ($safe) {
-      static::$safeStrings[$output]['html'] = TRUE;
-    }
+    static::$safeStrings[$output]['html'] = TRUE;
 
     return $output;
   }
diff --git a/core/lib/Drupal/Core/StringTranslation/TranslationInterface.php b/core/lib/Drupal/Core/StringTranslation/TranslationInterface.php
index c3e2f68..47c052a 100644
--- a/core/lib/Drupal/Core/StringTranslation/TranslationInterface.php
+++ b/core/lib/Drupal/Core/StringTranslation/TranslationInterface.php
@@ -25,7 +25,8 @@
    *   A string containing the English string to translate.
    * @param array $args
    *   An associative array of replacements to make after translation. Based
-   *   on the first character of the key, the value is escaped and/or themed.
+   *   on the first character of the key, the value is escaped and/or themed
+   *   (%, @), or XSS admin filtered if unsafe (!).
    *   See \Drupal\Component\Utility\SafeMarkup::format() for details.
    * @param array $options
    *   An associative array of additional options, with the following elements:
@@ -34,7 +35,7 @@
    *   - 'context': The context the source string belongs to.
    *
    * @return string
-   *   The translated string.
+   *   The translated string, which is marked as safe.
    *
    * @see \Drupal\Component\Utility\SafeMarkup::format()
    */
@@ -74,14 +75,15 @@ public function translate($string, array $args = array(), array $options = array
    *   An associative array of replacements to make after translation. Instances
    *   of any key in this array are replaced with the corresponding value.
    *   Based on the first character of the key, the value is escaped and/or
-   *   themed. See \Drupal\Component\Utility\SafeMarkup::format(). Note that you do
+   *   themed (%, @), or XSS admin filtered if unsafe (!).
+   *   See \Drupal\Component\Utility\SafeMarkup::format(). Note that you do
    *   not need to include @count in this array; this replacement is done
    *   automatically for the plural cases.
    * @param array $options
    *   An associative array of additional options. See t() for allowed keys.
    *
    * @return string
-   *   A translated string.
+   *   A translated string, which is marked as safe.
    *
    * @see self::translate()
    * @see t()
diff --git a/core/modules/migrate/src/MigrateExecutable.php b/core/modules/migrate/src/MigrateExecutable.php
index 1ed145d..fda2e57 100644
--- a/core/modules/migrate/src/MigrateExecutable.php
+++ b/core/modules/migrate/src/MigrateExecutable.php
@@ -237,7 +237,7 @@ public function import() {
     }
     catch (\Exception $e) {
       $this->message->display(
-        $this->t('Migration failed with source plugin exception: !e', array('!e' => $e->getMessage())), 'error');
+        $this->t('Migration failed with source plugin exception: @e', array('@e' => $e->getMessage())), 'error');
       $this->migration->setStatus(MigrationInterface::STATUS_IDLE);
       return MigrationInterface::RESULT_FAILED;
     }
diff --git a/core/modules/migrate/tests/src/Unit/MigrateExecutableTest.php b/core/modules/migrate/tests/src/Unit/MigrateExecutableTest.php
index eb1097c..e7c041a 100644
--- a/core/modules/migrate/tests/src/Unit/MigrateExecutableTest.php
+++ b/core/modules/migrate/tests/src/Unit/MigrateExecutableTest.php
@@ -7,6 +7,7 @@
 
 namespace Drupal\Tests\migrate\Unit;
 
+use Drupal\Component\Utility\Html;
 use Drupal\migrate\Entity\MigrationInterface;
 use Drupal\migrate\Plugin\MigrateIdMapInterface;
 use Drupal\migrate\MigrateException;
@@ -72,7 +73,7 @@ public function testImportWithFailingRewind() {
     // Ensure that a message with the proper message was added.
     $this->message->expects($this->once())
       ->method('display')
-      ->with("Migration failed with source plugin exception: $exception_message");
+      ->with('Migration failed with source plugin exception: ' . Html::escape($exception_message));
 
     $result = $this->executable->import();
     $this->assertEquals(MigrationInterface::RESULT_FAILED, $result);
diff --git a/core/modules/system/src/Tests/Common/XssUnitTest.php b/core/modules/system/src/Tests/Common/XssUnitTest.php
index f1358e0..74300b7 100644
--- a/core/modules/system/src/Tests/Common/XssUnitTest.php
+++ b/core/modules/system/src/Tests/Common/XssUnitTest.php
@@ -41,7 +41,7 @@ function testT() {
     $text = t('Placeholder text: %value', array('%value' => '<script>'));
     $this->assertEqual($text, 'Placeholder text: <em class="placeholder">&lt;script&gt;</em>', 't replaces, escapes and themes string.');
     $text = t('Verbatim text: !value', array('!value' => '<script>'));
-    $this->assertEqual($text, 'Verbatim text: <script>', 't replaces verbatim string as-is.');
+    $this->assertEqual($text, 'Verbatim text: ', 't XSS admin filters string.');
   }
 
   /**
diff --git a/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php b/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php
index 1278a6d..5aaea8d 100644
--- a/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php
+++ b/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php
@@ -166,13 +166,11 @@ function providerCheckPlain() {
    *   The expected result from calling the function.
    * @param string $message
    *   The message to display as output to the test.
-   * @param bool $expected_is_safe
-   *   Whether the result is expected to be safe for HTML display.
    */
-  function testFormat($string, $args, $expected, $message, $expected_is_safe) {
+  function testFormat($string, $args, $expected, $message) {
     $result = SafeMarkup::format($string, $args);
     $this->assertEquals($expected, $result, $message);
-    $this->assertEquals($expected_is_safe, SafeMarkup::isSafe($result), 'SafeMarkup::format correctly sets the result as safe or not safe.');
+    $this->assertTrue(SafeMarkup::isSafe($result), 'SafeMarkup::format correctly sets the result as safe for HTML display.');
   }
 
   /**
@@ -181,13 +179,13 @@ function testFormat($string, $args, $expected, $message, $expected_is_safe) {
    * @see testFormat()
    */
   function providerFormat() {
-    $tests[] = array('Simple text', array(), 'Simple text', 'SafeMarkup::format leaves simple text alone.', TRUE);
-    $tests[] = array('Escaped text: @value', array('@value' => '<script>'), 'Escaped text: &lt;script&gt;', 'SafeMarkup::format replaces and escapes string.', TRUE);
-    $tests[] = array('Escaped text: @value', array('@value' => SafeMarkupTestSafeString::create('<span>Safe HTML</span>')), 'Escaped text: <span>Safe HTML</span>', 'SafeMarkup::format does not escape an already safe string.', TRUE);
-    $tests[] = array('Placeholder text: %value', array('%value' => '<script>'), 'Placeholder text: <em class="placeholder">&lt;script&gt;</em>', 'SafeMarkup::format replaces, escapes and themes string.', TRUE);
-    $tests[] = array('Placeholder text: %value', array('%value' => SafeMarkupTestSafeString::create('<span>Safe HTML</span>')), 'Placeholder text: <em class="placeholder"><span>Safe HTML</span></em>', 'SafeMarkup::format does not escape an already safe string themed as a placeholder.', TRUE);
-    $tests[] = array('Verbatim text: !value', array('!value' => '<script>'), 'Verbatim text: <script>', 'SafeMarkup::format replaces verbatim string as-is.', FALSE);
-    $tests[] = array('Verbatim text: !value', array('!value' => SafeMarkupTestSafeString::create('<span>Safe HTML</span>')), 'Verbatim text: <span>Safe HTML</span>', 'SafeMarkup::format replaces verbatim string as-is.', TRUE);
+    $tests[] = array('Simple text', array(), 'Simple text', 'SafeMarkup::format leaves simple text alone.');
+    $tests[] = array('Escaped text: @value', array('@value' => '<script>'), 'Escaped text: &lt;script&gt;', 'SafeMarkup::format replaces and escapes string.');
+    $tests[] = array('Escaped text: @value', array('@value' => SafeMarkupTestSafeString::create('<span>Safe HTML</span>')), 'Escaped text: <span>Safe HTML</span>', 'SafeMarkup::format does not escape an already safe string.');
+    $tests[] = array('Placeholder text: %value', array('%value' => '<script>'), 'Placeholder text: <em class="placeholder">&lt;script&gt;</em>', 'SafeMarkup::format replaces, escapes and themes string.');
+    $tests[] = array('Placeholder text: %value', array('%value' => SafeMarkupTestSafeString::create('<span>Safe HTML</span>')), 'Placeholder text: <em class="placeholder"><span>Safe HTML</span></em>', 'SafeMarkup::format does not escape an already safe string themed as a placeholder.');
+    $tests[] = array('Verbatim text: !value', array('!value' => '<script>'), 'Verbatim text: ', 'SafeMarkup::format XSS admin filters an unsafe !replacement.');
+    $tests[] = array('Verbatim text: !value', array('!value' => SafeMarkupTestSafeString::create('<script>')), 'Verbatim text: <script>', 'SafeMarkup::format does not XSS admin filter a safe !replacement.');
 
     return $tests;
   }
diff --git a/core/tests/Drupal/Tests/Core/StringTranslation/TranslationManagerTest.php b/core/tests/Drupal/Tests/Core/StringTranslation/TranslationManagerTest.php
index 53165c9..61b4682 100644
--- a/core/tests/Drupal/Tests/Core/StringTranslation/TranslationManagerTest.php
+++ b/core/tests/Drupal/Tests/Core/StringTranslation/TranslationManagerTest.php
@@ -34,19 +34,19 @@ protected function setUp() {
    */
   public function providerTestFormatPlural() {
     return array(
-      array(1, 'Singular', '@count plural', array(), array(), 'Singular', TRUE),
-      array(2, 'Singular', '@count plural', array(), array(), '2 plural', TRUE),
+      array(1, 'Singular', '@count plural', array(), array(), 'Singular'),
+      array(2, 'Singular', '@count plural', array(), array(), '2 plural'),
       // @todo support locale_get_plural
-      array(2, 'Singular', '@count @arg', array('@arg' => '<script>'), array(), '2 &lt;script&gt;', TRUE),
-      array(2, 'Singular', '@count %arg', array('%arg' => '<script>'), array(), '2 <em class="placeholder">&lt;script&gt;</em>', TRUE),
-      array(2, 'Singular', '@count !arg', array('!arg' => '<script>'), array(), '2 <script>', FALSE),
+      array(2, 'Singular', '@count @arg', array('@arg' => '<script>'), array(), '2 &lt;script&gt;'),
+      array(2, 'Singular', '@count %arg', array('%arg' => '<script>'), array(), '2 <em class="placeholder">&lt;script&gt;</em>'),
+      array(2, 'Singular', '@count !arg', array('!arg' => '<script>'), array(), '2 '),
     );
   }
 
   /**
    * @dataProvider providerTestFormatPlural
    */
-  public function testFormatPlural($count, $singular, $plural, array $args = array(), array $options = array(), $expected, $safe) {
+  public function testFormatPlural($count, $singular, $plural, array $args = array(), array $options = array(), $expected) {
     $translator = $this->getMock('\Drupal\Core\StringTranslation\Translator\TranslatorInterface');
     $translator->expects($this->once())
       ->method('getStringTranslation')
@@ -56,7 +56,7 @@ public function testFormatPlural($count, $singular, $plural, array $args = array
     $this->translationManager->addTranslator($translator);
     $result = $this->translationManager->formatPlural($count, $singular, $plural, $args, $options);
     $this->assertEquals($expected, $result);
-    $this->assertEquals(SafeMarkup::isSafe($result), $safe);
+    $this->assertTrue(SafeMarkup::isSafe($result));
   }
 
 }