diff --git a/activemq-karaf/src/main/resources/features-core.xml b/activemq-karaf/src/main/resources/features-core.xml
index 5a1748a99c7..af3ba4631f2 100644
--- a/activemq-karaf/src/main/resources/features-core.xml
+++ b/activemq-karaf/src/main/resources/features-core.xml
@@ -40,6 +40,8 @@
         <bundle dependency="true">mvn:org.apache.geronimo.specs/geronimo-annotation_1.3_spec/1.0</bundle>
         <bundle dependency="true">mvn:org.apache.geronimo.specs/geronimo-jta_1.1_spec/1.1.1</bundle>
         <bundle>mvn:org.apache.commons/commons-pool2/${commons-pool2-version}</bundle>
+        <bundle>mvn:org.apache.commons/commons-lang3/${commons-lang3-version}</bundle>
+        <bundle>mvn:org.apache.commons/commons-text/${commons-text-version}</bundle>
         <!-- uber osgi bundle means client is not that lean, todo: introduce client osgi bundle -->
         <bundle>mvn:org.apache.activemq/activemq-osgi/${project.version}</bundle>
     </feature>
diff --git a/activemq-web/pom.xml b/activemq-web/pom.xml
index 6c1f85d28a8..900b4a2c5c3 100644
--- a/activemq-web/pom.xml
+++ b/activemq-web/pom.xml
@@ -87,6 +87,11 @@
       <artifactId>websocket-jetty-server</artifactId>
     </dependency>
 
+    <dependency>
+      <groupId>org.apache.commons</groupId>
+      <artifactId>commons-text</artifactId>
+    </dependency>
+
     <!-- Rome RSS Reader -->
     <dependency>
       <groupId>com.rometools</groupId>
diff --git a/activemq-web/src/main/java/org/apache/activemq/web/view/RssMessageRenderer.java b/activemq-web/src/main/java/org/apache/activemq/web/view/RssMessageRenderer.java
index 088a4c1926b..f05d0467833 100644
--- a/activemq-web/src/main/java/org/apache/activemq/web/view/RssMessageRenderer.java
+++ b/activemq-web/src/main/java/org/apache/activemq/web/view/RssMessageRenderer.java
@@ -49,7 +49,7 @@ public class RssMessageRenderer extends SimpleMessageRenderer {
     private String feedType = "rss_2.0";
     private SyndFeed feed;
     private String description = "This feed is auto-generated by Apache ActiveMQ";
-    private String entryContentType = "text/plain";
+    private static final String ENTRY_CONTENT_TYPE = "text/plain";
 
     public void renderMessage(PrintWriter writer, HttpServletRequest request, HttpServletResponse response, QueueBrowser browser, Message message) throws JMSException {
         SyndFeed feed = getFeed(browser, request);
@@ -79,11 +79,7 @@ public void setFeedType(String feedType) {
     }
 
     public String getEntryContentType() {
-        return entryContentType;
-    }
-
-    public void setEntryContentType(String entryContentType) {
-        this.entryContentType = entryContentType;
+        return ENTRY_CONTENT_TYPE;
     }
 
     // Implementation methods
@@ -122,7 +118,7 @@ protected SyndEntry createEntry(QueueBrowser browser, Message message, HttpServl
 
     protected SyndContent createEntryContent(QueueBrowser browser, Message message, HttpServletRequest request) throws JMSException {
         SyndContent description = new SyndContentImpl();
-        description.setType(entryContentType);
+        description.setType(getEntryContentType());
 
         if (message instanceof TextMessage) {
             String text = ((TextMessage)message).getText();
diff --git a/activemq-web/src/main/java/org/apache/activemq/web/view/SimpleMessageRenderer.java b/activemq-web/src/main/java/org/apache/activemq/web/view/SimpleMessageRenderer.java
index f8165d8849a..403bffde4af 100644
--- a/activemq-web/src/main/java/org/apache/activemq/web/view/SimpleMessageRenderer.java
+++ b/activemq-web/src/main/java/org/apache/activemq/web/view/SimpleMessageRenderer.java
@@ -26,6 +26,7 @@
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
+import org.apache.commons.text.StringEscapeUtils;
 
 /**
  * A simple rendering of the contents of a queue appear as a list of message
@@ -35,11 +36,12 @@
  */
 public class SimpleMessageRenderer implements MessageRenderer {
 
-    private String contentType = "text/xml";
+    protected static final String DEFAULT_CONTENT_TYPE = "text/xml";
+
     private int maxMessages;
 
     public void renderMessages(HttpServletRequest request, HttpServletResponse response, QueueBrowser browser) throws IOException, JMSException, ServletException {
-        // lets use XML by default
+        // XML is used by default unless a child class overrides this method
         response.setContentType(getContentType());
         PrintWriter writer = response.getWriter();
         printHeader(writer, browser, request);
@@ -53,10 +55,10 @@ public void renderMessages(HttpServletRequest request, HttpServletResponse respo
         printFooter(writer, browser, request);
     }
 
-    public void renderMessage(PrintWriter writer, HttpServletRequest request, HttpServletResponse response, QueueBrowser browser, Message message) throws JMSException, ServletException {
+    public void renderMessage(PrintWriter writer, HttpServletRequest request, HttpServletResponse response, QueueBrowser browser, Message message) throws JMSException {
         // lets just write the message IDs for now
         writer.print("<message id='");
-        writer.print(message.getJMSMessageID());
+        writer.print(StringEscapeUtils.escapeXml11(message.getJMSMessageID()));
         writer.println("'/>");
     }
 
@@ -71,25 +73,21 @@ public void setMaxMessages(int maxMessages) {
     }
 
     public String getContentType() {
-        return contentType;
-    }
-
-    public void setContentType(String contentType) {
-        this.contentType = contentType;
+        return DEFAULT_CONTENT_TYPE;
     }
 
     // Implementation methods
     // -------------------------------------------------------------------------
 
-    protected void printHeader(PrintWriter writer, QueueBrowser browser, HttpServletRequest request) throws IOException, JMSException, ServletException {
+    protected void printHeader(PrintWriter writer, QueueBrowser browser, HttpServletRequest request) throws IOException, JMSException {
         writer.println("");
         writer.print("<messages queue='");
-        writer.print(browser.getQueue());
+        writer.print(StringEscapeUtils.escapeXml11(String.valueOf(browser.getQueue())));
         writer.print("'");
         String selector = browser.getMessageSelector();
         if (selector != null) {
             writer.print(" selector='");
-            writer.print(selector);
+            writer.print(StringEscapeUtils.escapeXml11(selector));
             writer.print("'");
         }
         writer.println(">");
diff --git a/assembly/src/main/descriptors/common-bin.xml b/assembly/src/main/descriptors/common-bin.xml
index 833e3f7dc66..e7aaecbe380 100644
--- a/assembly/src/main/descriptors/common-bin.xml
+++ b/assembly/src/main/descriptors/common-bin.xml
@@ -308,6 +308,10 @@
         <include>com.rometools:rome-utils</include>
         <include>org.jdom:jdom2</include>
 
+        <!-- String text utils -->
+        <include>org.apache.commons:commons-text</include>
+        <include>org.apache.commons:commons-lang3</include>
+
         <!-- REST API -->
         <include>org.jolokia:jolokia-core</include>
         <include>org.jolokia:jolokia-server-core</include>
diff --git a/pom.xml b/pom.xml
index 260f4342fa2..3ba6b26b03d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -58,6 +58,8 @@
     <commons-collections-version>3.2.2</commons-collections-version>
     <commons-dbcp2-version>2.14.0</commons-dbcp2-version>
     <commons-io-version>2.21.0</commons-io-version>
+    <commons-lang3-version>3.20.0</commons-lang3-version>
+    <commons-text-version>1.15.0</commons-text-version>
     <commons-logging-version>1.3.6</commons-logging-version>
     <commons-pool2-version>2.13.1</commons-pool2-version>
     <directory-version>2.0.0.AM25</directory-version>
@@ -901,6 +903,17 @@
         <version>${commons-io-version}</version>
       </dependency>
 
+      <dependency>
+        <groupId>org.apache.commons</groupId>
+        <artifactId>commons-lang3</artifactId>
+        <version>${commons-lang3-version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.apache.commons</groupId>
+        <artifactId>commons-text</artifactId>
+        <version>${commons-text-version}</version>
+      </dependency>
+
       <!-- ACTIVEMQ-WEB Specific Dependencies -->
       <dependency>
         <groupId>com.rometools</groupId>