diff --git a/htdocs/user/passwordforgotten.php b/htdocs/user/passwordforgotten.php
index 789d67544a3..b29bb0e6d70 100644
--- a/htdocs/user/passwordforgotten.php
+++ b/htdocs/user/passwordforgotten.php
@@ -71,7 +71,7 @@ if ($action == 'validatenewpassword' && $username && $passwordhash)
 	$result = $edituser->fetch('', $_GET["username"]);
 	if ($result < 0)
 	{
-		$message = '<div class="error">'.$langs->trans("ErrorLoginDoesNotExists", $username).'</div>';
+		$message = '<div class="error">'.dol_escape_htmltag($langs->trans("ErrorLoginDoesNotExists", $username)).'</div>';
 	} else {
 		if (dol_verifyHash($edituser->pass_temp, $passwordhash))
 		{