diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc
index 1cca1bad70..4e5e652f92 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc
@@ -1,5 +1,6 @@
 [% USE raw %]
 [% USE Koha %]
+[% USE HtmlScrubber %]
 [% PROCESS 'restriction-types.inc' %]
 
 [% IF ( patron.restrictions.count == 0 ) %]
@@ -23,9 +24,9 @@
                     <td> [% PROCESS restriction_type_description restriction_type=restriction.type %] </td>
                     <td>
                         [% IF restriction.comment.search('OVERDUES_PROCESS') %]
-                            <span>Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | $raw %]</span>
+                            <span>Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | scrub_html type => 'comment' | $raw %]</span>
                         [% ELSE %]
-                            [% restriction.comment | $raw %]
+                            [% restriction.comment | scrub_html type => 'comment' | $raw %]
                         [% END %]
                     </td>
                     <td>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc
index 9de73ac63b..4005586158 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc
@@ -1,5 +1,6 @@
 [% USE raw %]
 [% USE Branches %]
+[% USE HtmlScrubber %]
 [% USE Categories %]
 [% SET ClaimReturnedWarningThreshold = Koha.Preference('ClaimReturnedWarningThreshold') || 0 %]
 [% SET return_claims = patron.return_claims %]
@@ -104,10 +105,10 @@
                                 [% END %]
                             </span>
                             [% IF restriction.comment.search('OVERDUES_PROCESS') %]
-                                Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | $raw | html_line_break %]
+                                Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | scrub_html type => 'comment' | $raw | html_line_break %]
                             [% ELSE %]
                                 [% IF restriction.comment %]
-                                    <span class="restriction_detail">[%- restriction.comment | html_line_break -%]</span>
+                                    <span class="restriction_detail">[%- restriction.comment | scrub_html type => 'comment' | html_line_break -%]</span>
                                 [% END %]
                             [% END %]
                             <span class="restriction_type">([%- restriction.type.display_text | html -%])</span>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
index a8a5adc3ed..8d93473960 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
@@ -3,6 +3,7 @@
 [% USE To %]
 [% USE Koha %]
 [% USE KohaDates %]
+[% USE HtmlScrubber %]
 [% USE Branches %]
 [% PROCESS 'member-main-address-style.inc' %]
 [% PROCESS 'member-alt-address-style.inc' %]
@@ -1390,9 +1391,9 @@
                                                         <td>[% PROCESS restriction_type_description restriction_type=restriction.type %]</td>
                                                         <td>
                                                             [% IF restriction.comment.search('OVERDUES_PROCESS') %]
-                                                                Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | $raw %]
+                                                                Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | scrub_html type => 'comment' | $raw %]
                                                             [% ELSE %]
-                                                                [% restriction.comment | $raw %]
+                                                                [% restriction.comment | scrub_html type => 'comment' | $raw %]
                                                             [% END %]
                                                         </td>
                                                         <td>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/patron-restrictions.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/patron-restrictions.inc
index 5ca6ea5909..9cc970889c 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/patron-restrictions.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/patron-restrictions.inc
@@ -1,3 +1,4 @@
+[% USE HtmlScrubber %]
 <li class="userdebarred blocker">
     <strong>Your account has been frozen</strong>
     <ul>
@@ -11,10 +12,10 @@
                     [% END %]
                 </span>
                 [% IF restriction.comment.search('OVERDUES_PROCESS') %]
-                    <span class="restriction_detail">Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | $raw | html_line_break %]</span>
+                    <span class="restriction_detail">Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | scrub_html type => 'comment' | $raw | html_line_break %]</span>
                 [% ELSE %]
                     [% IF restriction.comment %]
-                        <span class="restriction_detail">[%- restriction.comment | html_line_break -%]</span>
+                        <span class="restriction_detail">[%- restriction.comment | scrub_html type => 'comment' | html_line_break -%]</span>
                     [% END %]
                 [% END %]
             </li>