diff --git a/addons/website_crm_partner_assign/models/crm_lead.py b/addons/website_crm_partner_assign/models/crm_lead.py
index 817169bb56e..241ff642b5b 100644
--- a/addons/website_crm_partner_assign/models/crm_lead.py
+++ b/addons/website_crm_partner_assign/models/crm_lead.py
@@ -5,6 +5,8 @@ import random
 
 from odoo import api, fields, models, _
 from odoo.exceptions import AccessDenied, AccessError
+from odoo.tools import html_escape
+
 
 
 class CrmLead(models.Model):
@@ -174,7 +176,7 @@ class CrmLead(models.Model):
     def partner_interested(self, comment=False):
         message = _('<p>I am interested by this lead.</p>')
         if comment:
-            message += '<p>%s</p>' % comment
+            message += '<p>%s</p>' % html_escape(comment)
         for lead in self:
             lead.message_post(body=message)
             lead.sudo().convert_opportunity(lead.partner_id.id)  # sudo required to convert partner data
@@ -188,7 +190,7 @@ class CrmLead(models.Model):
             [('id', 'child_of', self.env.user.partner_id.commercial_partner_id.id)])
         self.message_unsubscribe(partner_ids=partner_ids.ids)
         if comment:
-            message += '<p>%s</p>' % comment
+            message += '<p>%s</p>' % html_escape(comment)
         self.message_post(body=message)
         values = {
             'partner_assigned_id': False,