diff --git a/addons/crm/models/crm_lead.py b/addons/crm/models/crm_lead.py
index 509643801ff..f510265f91a 100644
--- a/addons/crm/models/crm_lead.py
+++ b/addons/crm/models/crm_lead.py
@@ -6,6 +6,7 @@ import pytz
 import threading
 from collections import OrderedDict, defaultdict
 from datetime import date, datetime, timedelta
+from markupsafe import Markup
 from psycopg2 import sql
 
 from odoo import api, fields, models, tools, SUPERUSER_ID
@@ -1254,10 +1255,12 @@ class Lead(models.Model):
             ('alias_parent_model_id.model', '=', 'crm.team'),
             ('alias_force_thread_id', '=', False)
         ], limit=1)
+
         if alias_record and alias_record.alias_domain and alias_record.alias_name:
-            email = '%s@%s' % (alias_record.alias_name, alias_record.alias_domain)
-            email_link = "<b><a href='mailto:%s'>%s</a></b>" % (email, email)
-            sub_title = _('Use the top left <i>Create</i> button, or send an email to %s to test the email gateway.') % (email_link)
+            email = f'{alias_record.alias_name}@{alias_record.alias_domain}'
+            sub_title = Markup(_('Use the top left <i>Create</i> button, or send an email to %(email_link)s to test the email gateway.')) % {
+                'email_link': Markup("<b><a href='mailto:%s'>%s</a></b>") % (email, email),
+            }
         return super().get_empty_list_help(
             f'<p class="o_view_nocontent_smiling_face">{help_title}</p><p class="oe_view_nocontent_alias">{sub_title}</p>'
         )
diff --git a/addons/hr_recruitment/models/hr_recruitment.py b/addons/hr_recruitment/models/hr_recruitment.py
index ba9ac39052e..90e12769834 100644
--- a/addons/hr_recruitment/models/hr_recruitment.py
+++ b/addons/hr_recruitment/models/hr_recruitment.py
@@ -1,6 +1,7 @@
 # -*- coding: utf-8 -*-
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
+from markupsafe import Markup
 from random import randint
 
 from odoo import api, fields, models, tools, SUPERUSER_ID
@@ -437,25 +438,27 @@ class Applicant(models.Model):
     def get_empty_list_help(self, help_message):
         if 'active_id' in self.env.context and self.env.context.get('active_model') == 'hr.job':
             alias_id = self.env['hr.job'].browse(self.env.context['active_id']).alias_id
+        elif self.env.context.get('default_job_id'):
+            alias_id = self.env['hr.job'].browse(self.env.context['default_job_id']).alias_id
         else:
             alias_id = False
 
-        nocontent_values = {
+        nocontent_body = Markup("""
+<p class="o_view_nocontent_empty_folder">%(help_title)s</p>
+<p>%(para_1)s<br/>%(para_2)s</p>""") % {
             'help_title': _('No application yet'),
             'para_1': _('Let people apply by email to save time.') ,
             'para_2': _('Attachments, like resumes, get indexed automatically.'),
         }
-        nocontent_body = """
-            <p class="o_view_nocontent_empty_folder">%(help_title)s</p>
-            <p>%(para_1)s<br/>%(para_2)s</p>"""
 
         if alias_id and alias_id.alias_domain and alias_id.alias_name:
             email = alias_id.display_name
-            email_link = "<a href='mailto:%s'>%s</a>" % (email, email)
-            nocontent_values['email_link'] = email_link
-            nocontent_body += """<p class="o_copy_paste_email oe_view_nocontent_alias">%(email_link)s</p>"""
+            nocontent_body += Markup('<p class="o_copy_paste_email oe_view_nocontent_alias">%(helper_email)s <a href="mailto:%(email)s">%(email)s</a></p>') % {
+                'helper_email': _("Create new applications by sending an email to"),
+                'email': email
+            }
 
-        return super().get_empty_list_help(nocontent_body % nocontent_values)
+        return super().get_empty_list_help(nocontent_body)
 
     @api.model
     def get_view(self, view_id=None, view_type='form', **options):
diff --git a/addons/mail/models/mail_gateway_allowed.py b/addons/mail/models/mail_gateway_allowed.py
index e5f79959689..f35f0ad4b5e 100644
--- a/addons/mail/models/mail_gateway_allowed.py
+++ b/addons/mail/models/mail_gateway_allowed.py
@@ -1,6 +1,7 @@
 # -*- coding: utf-8 -*-
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
+from markupsafe import Markup
 from odoo import _, api, fields, models, tools
 
 
@@ -35,13 +36,15 @@ class MailGatewayAllowed(models.Model):
         LOOP_MINUTES = int(get_param('mail.gateway.loop.minutes', 120))
         LOOP_THRESHOLD = int(get_param('mail.gateway.loop.threshold', 20))
 
-        return _('''
+        return Markup(_('''
             <p class="o_view_nocontent_smiling_face">
                 Add addresses to the Allowed List
             </p><p>
                 To protect you from spam and reply loops, Odoo automatically blocks emails
-                coming to your gateway past a threshold of <b>%i</b> emails every <b>%i</b>
+                coming to your gateway past a threshold of <b>%(threshold)i</b> emails every <b>%(minutes)i</b>
                 minutes. If there are some addresses from which you need to receive very frequent
                 updates, you can however add them below and Odoo will let them go through.
-            </p>
-        ''', LOOP_THRESHOLD, LOOP_MINUTES)
+            </p>''')) % {
+            'threshold': LOOP_THRESHOLD,
+            'minutes': LOOP_MINUTES,
+        }
diff --git a/addons/mail/models/mail_thread.py b/addons/mail/models/mail_thread.py
index df0afdd4cce..7aec4d246e3 100644
--- a/addons/mail/models/mail_thread.py
+++ b/addons/mail/models/mail_thread.py
@@ -28,7 +28,7 @@ from markupsafe import Markup
 from odoo import _, api, exceptions, fields, models, tools, registry, SUPERUSER_ID, Command
 from odoo.exceptions import MissingError, AccessError
 from odoo.osv import expression
-from odoo.tools import is_html_empty
+from odoo.tools import is_html_empty, html_escape
 from odoo.tools.misc import clean_context, split_every
 
 _logger = logging.getLogger(__name__)
@@ -367,28 +367,24 @@ class MailThread(models.AbstractModel):
                 alias = aliases[0]
 
         if alias:
-            email_link = "<a href='mailto:%(email)s'>%(email)s</a>" % {'email': alias.display_name}
+            email_link = Markup("<a href='mailto:%s'>%s</a>") % (alias.display_name, alias.display_name)
             if nothing_here:
-                return super().get_empty_list_help("<p class='o_view_nocontent_smiling_face'>%(dyn_help)s</p>" % {
-                    'dyn_help': _("Add a new %(document)s or send an email to %(email_link)s",
-                        document=document_name,
-                        email_link=email_link,
-                    )
-                })
+                dyn_help = _("Add a new %(document)s or send an email to %(email_link)s",
+                             document=html_escape(document_name),
+                             email_link=email_link,
+                            )
+                return super().get_empty_list_help(f"<p class='o_view_nocontent_smiling_face'>{dyn_help}</p>")
             # do not add alias two times if it was added previously
             if "oe_view_nocontent_alias" not in help_message:
-                return super().get_empty_list_help("%(static_help)s<p class='oe_view_nocontent_alias'>%(dyn_help)s</p>" % {
-                    'static_help': help_message,
-                    'dyn_help': _("Create new %(document)s by sending an email to %(email_link)s",
-                        document=document_name,
-                        email_link=email_link,
-                    )
-                })
+                dyn_help = _("Create new %(document)s by sending an email to %(email_link)s",
+                             document=html_escape(document_name),
+                             email_link=email_link,
+                            )
+                return super().get_empty_list_help(f"{help_message}<p class='oe_view_nocontent_alias'>{dyn_help}</p>")
 
         if nothing_here:
-            return super().get_empty_list_help("<p class='o_view_nocontent_smiling_face'>%(dyn_help)s</p>" % {
-                'dyn_help': _("Create new %(document)s", document=document_name),
-            })
+            dyn_help = _("Create new %(document)s", document=html_escape(document_name))
+            return super().get_empty_list_help(f"<p class='o_view_nocontent_smiling_face'>{dyn_help}</p>")
 
         return super().get_empty_list_help(help_message)