diff --git a/BatchIngest.inc b/BatchIngest.inc
index 621a674a..f4d987e0 100644
--- a/BatchIngest.inc
+++ b/BatchIngest.inc
@@ -229,7 +229,7 @@ function batch_create_dc_from_mods($mods_xml) {
   try {
     $proc = new XsltProcessor();
   } catch (Exception $e) {
-    drupal_set_message(t("!e", array('!e' => $e->getMessage())), 'error');
+    drupal_set_message(t("!e", array('!e' => check_plain($e->getMessage()))), 'error');
     return " ";
   }
 
diff --git a/CollectionClass.inc b/CollectionClass.inc
index ae68e2de..3d2c9f5b 100644
--- a/CollectionClass.inc
+++ b/CollectionClass.inc
@@ -131,7 +131,7 @@ class CollectionClass {
     try {
       $xml = new SimpleXMLElement($stream);
     } catch (Exception $e) {
-      drupal_set_message(t('Error getting relationship element from policy stream !e', array('!e' => $e->getMessage())), 'error');
+      drupal_set_message(t('Error getting relationship element from policy stream !e', array('!e' => check_plain($e->getMessage()))), 'error');
       return;
     }
     $relationship = $xml->relationship[0];
@@ -172,7 +172,7 @@ class CollectionClass {
     try {
       $xml = new SimpleXMLElement($stream);
     } catch (Exception $e) {
-      drupal_set_message(t('Error getting PID namespace !e', array('!e' => $e->getMessage())), 'error');
+      drupal_set_message(t('Error getting PID namespace !e', array('!e' => check_plain($e->getMessage()))), 'error');
       return;
     }
     foreach ($xml->contentmodels->contentmodel as $contentModel) {
@@ -199,7 +199,7 @@ class CollectionClass {
       $xml = new SimpleXMLElement($collection_stream);
     } catch (Exception $e) {
       if ($showError) {
-        drupal_set_message(t("!e", array('!e' => $e->getMessage())), 'error');
+        drupal_set_message(t("!e", array('!e' => check_plain($e->getMessage()))), 'error');
       }
       return NULL;
     }
@@ -239,7 +239,7 @@ class CollectionClass {
     try {
       $xml = new SimpleXMLElement($stream);
     } catch (Exception $e) {
-      drupal_set_message(t('Error Getting FormHandler: !e', array('!e' => $e->getMessage())), 'error');
+      drupal_set_message(t('Error Getting FormHandler: !e', array('!e' => check_plain($e->getMessage()))), 'error');
       return NULL;
     }
     $formHandler = $xml->ingest_form;
@@ -272,7 +272,7 @@ class CollectionClass {
     try {
       $xml = new SimpleXMLElement($stream);
     } catch (Exception $e) {
-      drupal_set_message(t('Error getting content model stream for mime types !e', array('!e' => $e->getMessage())), 'error');
+      drupal_set_message(t('Error getting content model stream for mime types !e', array('!e' => check_plain($e->getMessage()))), 'error');
       return;
     }
     foreach ($xml->mimetypes->type as $type) {
@@ -302,7 +302,7 @@ class CollectionClass {
     try {
       $xml = new SimpleXMLElement($stream);
     } catch (Exception $e) {
-      drupal_set_message(t('Error getting content model stream !e', array('!e' => $e->getMessage())), 'error');
+      drupal_set_message(t('Error getting content model stream !e', array('!e' => check_plain($e->getMessage()))), 'error');
       return FALSE;
     }
     foreach ($xml->ingest_rules->rule as $rule) {
@@ -365,7 +365,7 @@ class CollectionClass {
     try {
       $xml = new SimpleXMLElement($stream);
     } catch (Exception $e) {
-      drupal_set_message(t('Error getting ingest form stream !e', array('!e' => $e->getMessage())), 'error');
+      drupal_set_message(t('Error getting ingest form stream !e', array('!e' => check_plain($e->getMessage()))), 'error');
       return FALSE;
     }
     $docRoot = $_SERVER['DOCUMENT_ROOT'];
@@ -451,7 +451,7 @@ class CollectionClass {
             $params
           ));
     } catch (exception $e) {
-      drupal_set_message(t('Error getting Next PID: !e', array('!e' => $e->getMessage())), 'error');
+      drupal_set_message(t('Error getting Next PID: !e', array('!e' => check_plain($e->getMessage()))), 'error');
       return FALSE;
     }
     $pid = implode(get_object_vars($object));
@@ -663,7 +663,7 @@ class CollectionClass {
             throw new Exception("Invalid XML.");
           }
         } catch (Exception $e) {
-          drupal_set_message(t('!e', array('!e' => $e->getMessage())), 'error');
+          drupal_set_message(t('!e', array('!e' => check_plain($e->getMessage()))), 'error');
           return '';
         }
       }
diff --git a/ConnectionHelper.inc b/ConnectionHelper.inc
index 255ebfac..71cca98d 100644
--- a/ConnectionHelper.inc
+++ b/ConnectionHelper.inc
@@ -71,7 +71,7 @@ class ConnectionHelper {
             'exceptions' => $exceptions,
           ));
       } catch (SoapFault $e) {
-        drupal_set_message(t("!e", array('!e' => $e->getMessage())));
+        drupal_set_message(t("!e", array('!e' => check_plain($e->getMessage()))));
         return NULL;
       }
     }
@@ -83,7 +83,7 @@ class ConnectionHelper {
             'exceptions' => TRUE,
           ));
       } catch (SoapFault $e) {
-        drupal_set_message(t("!e", array('!e' => $e->getMessage())));
+        drupal_set_message(t("!e", array('!e' => check_plain($e->getMessage()))));
         return NULL;
       }
     }
diff --git a/ObjectHelper.inc b/ObjectHelper.inc
index 98160292..ed3aec38 100644
--- a/ObjectHelper.inc
+++ b/ObjectHelper.inc
@@ -750,7 +750,7 @@ class ObjectHelper {
     try {
       $parent_collections = new SimpleXMLElement($parent_collections);
     } catch (exception $e) {
-      drupal_set_message(t('Error getting parent objects !e', array('!e' => $e->getMessage())));
+      drupal_set_message(t('Error getting parent objects !e', array('!e' => check_plain($e->getMessage()))));
       return;
     }
 
diff --git a/plugins/DarwinCore.inc b/plugins/DarwinCore.inc
index 5ab525b6..1071c5e0 100644
--- a/plugins/DarwinCore.inc
+++ b/plugins/DarwinCore.inc
@@ -261,7 +261,7 @@ class DarwinCore {
     try {
       $proc = new XsltProcessor();
     } catch (Exception $e) {
-      drupal_set_message(t("!e", array('!e' => $e->getMessage())), 'error');
+      drupal_set_message(t("!e", array('!e' => check_plain($e->getMessage()))), 'error');
       return " ";
     }
 
diff --git a/plugins/Flv.inc b/plugins/Flv.inc
index f51e2194..0e248b71 100644
--- a/plugins/Flv.inc
+++ b/plugins/Flv.inc
@@ -69,7 +69,7 @@ class FormBuilder {
             $oai->appendChild($previousElement);
           }
         } catch (exception $e) {
-          drupal_set_message(t("!e", array('!e' => $e->getMessage())), 'error');
+          drupal_set_message(t("!e", array('!e' => check_plain($e->getMessage()))), 'error');
           continue;
         }
       }
@@ -126,7 +126,7 @@ class FormBuilder {
         unlink($form_values['fullpath']);
       }
     } catch (exception $e) {
-      drupal_set_message(t('Error ingesting object: !e', array('!e' => $e->getMessage())), 'error');
+      drupal_set_message(t('Error ingesting object: !e', array('!e' => check_plain($e->getMessage()))), 'error');
       return;
     }
   }
diff --git a/plugins/FormBuilder.inc b/plugins/FormBuilder.inc
index 6da718fa..d44e1f9b 100644
--- a/plugins/FormBuilder.inc
+++ b/plugins/FormBuilder.inc
@@ -68,7 +68,7 @@ class FormBuilder {
             $oai->appendChild($previousElement);
           }
         } catch (exception $e) {
-          drupal_set_message(t("!e", array('!e' => $e->getMessage())), 'error');
+          drupal_set_message(t("!e", array('!e' => check_plain($e->getMessage()))), 'error');
           continue;
         }
       }
@@ -96,7 +96,7 @@ class FormBuilder {
       $xml = new SimpleXMLElement($policyStreamDoc);
     } catch (Exception $e) {
       watchdog(t("Fedora_Repository"), t("Problem getting security policy."), NULL, WATCHDOG_ERROR);
-      drupal_set_message(t('Problem getting security policy: !e', array('!e' => $e->getMessage())), 'error');
+      drupal_set_message(t('Problem getting security policy: !e', array('!e' => check_plain($e->getMessage()))), 'error');
       return FALSE;
     }
     $policyElement = $dom->createDocumentFragment();
@@ -182,8 +182,8 @@ class FormBuilder {
       }
       file_delete($form_values['ingest-file-location']);
     } catch (exception $e) {
-      drupal_set_message(t('Error ingesting object: !e', array('!e' => $e->getMessage())), 'error');
-      watchdog(t("Fedora_Repository"), "Error ingesting object: !e", array('!e' => $e->getMessage()), NULL, WATCHDOG_ERROR);
+      drupal_set_message(t('Error ingesting object: !e', array('!e' => check_plain($e->getMessage()))), 'error');
+      watchdog(t("Fedora_Repository"), "Error ingesting object: !e", array('!e' => check_plain($e->getMessage())), NULL, WATCHDOG_ERROR);
       return;
     }
   }
diff --git a/plugins/ModsFormBuilder.inc b/plugins/ModsFormBuilder.inc
index b9ace70b..05ae0a99 100644
--- a/plugins/ModsFormBuilder.inc
+++ b/plugins/ModsFormBuilder.inc
@@ -316,8 +316,8 @@ class ModsFormBuilder extends FormBuilder {
       }
       file_delete($form_values['ingest-file-location']);
     } catch (exception $e) {
-      drupal_set_message(t('Error ingesting object: !e', array('!e' => $e->getMessage())), 'error');
-      watchdog(t("Fedora_Repository"), "Error ingesting object: !e", array('!e' => $e->getMessage()), NULL, WATCHDOG_ERROR);
+      drupal_set_message(t('Error ingesting object: !e', array('!e' => check_plain($e->getMessage()))), 'error');
+      watchdog(t("Fedora_Repository"), "Error ingesting object: !e", array('!e' => check_plain($e->getMessage())), NULL, WATCHDOG_ERROR);
       return;
     }
   }
diff --git a/plugins/PersonalCollectionClass.inc b/plugins/PersonalCollectionClass.inc
index 39dc68d0..6d5b0946 100644
--- a/plugins/PersonalCollectionClass.inc
+++ b/plugins/PersonalCollectionClass.inc
@@ -57,7 +57,7 @@ class PersonalCollectionClass {
           $params
         ));
     } catch (exception $e) {
-      drupal_set_message(t('Error ingesting personal collection object: !e', array('!e' => $e->getMessage())), 'error');
+      drupal_set_message(t('Error ingesting personal collection object: !e', array('!e' => check_plain($e->getMessage()))), 'error');
       return FALSE;
     }
     return TRUE;
@@ -76,7 +76,7 @@ class PersonalCollectionClass {
       $xml = new SimpleXMLElement($collectionTemplate);
     } catch (Exception $e) {
       watchdog(t("Fedora_Repository"), t("Problem creating personal collection policy, could not parse collection policy stream."), NULL, WATCHDOG_ERROR);
-      drupal_set_message(t('Problem creating personal collection policy, could not parse collection policy stream: !e', array('!e' => $e->getMessage())), 'error');
+      drupal_set_message(t('Problem creating personal collection policy, could not parse collection policy stream: !e', array('!e' => check_plain($e->getMessage()))), 'error');
       return FALSE;
     }
     $policyElement = $dom->createDocumentFragment();
diff --git a/plugins/ShowStreamsInFieldSets.inc b/plugins/ShowStreamsInFieldSets.inc
index e13dce33..23d5a4dc 100644
--- a/plugins/ShowStreamsInFieldSets.inc
+++ b/plugins/ShowStreamsInFieldSets.inc
@@ -183,7 +183,7 @@ class ShowStreamsInFieldSets {
     try {
       $proc = new XsltProcessor();
     } catch (Exception $e) {
-      drupal_set_message(t("!e", array('!e' => $e->getMessage())), 'error');
+      drupal_set_message(t("!e", array('!e' => check_plain($e->getMessage()))), 'error');
       return " ";
     }
     $xsl = new DomDocument();
@@ -237,7 +237,7 @@ class ShowStreamsInFieldSets {
     try {
       $proc = new XsltProcessor();
     } catch (Exception $e) {
-      drupal_set_message(t("!e", array('!e' => $e->getMessage())), 'error');
+      drupal_set_message(t("!e", array('!e' => check_plain($e->getMessage()))), 'error');
       return;
     }
     $xsl = new DomDocument();