diff --git a/userfiles/modules/files/browser.php b/userfiles/modules/files/browser.php
index e56f9d429ca..e775ce2d958 100644
--- a/userfiles/modules/files/browser.php
+++ b/userfiles/modules/files/browser.php
@@ -90,6 +90,7 @@
 }
 
 ?>
+
 <script>
 
     var back = function () {
diff --git a/userfiles/modules/files/files_admin.js b/userfiles/modules/files/files_admin.js
index e3a15c81b7f..d0fed755273 100644
--- a/userfiles/modules/files/files_admin.js
+++ b/userfiles/modules/files/files_admin.js
@@ -1,3 +1,7 @@
+
+mw.lib.require('xss');
+
+
 createPopHTML = function (sourceUrl, type) {
     type = type || 'image';
     var h;
@@ -69,6 +73,9 @@ deleteItem = function (url, name, frommodal) {
 if (self === parent) {
     mw.on.hashParam('select-file', function (pval) {
         var dialog;
+
+        pval = filterXSS(pval);
+
         if (pval.valueOf()) {
             var type = pval.valueOf().split(".").pop();
             type = type.toLowerCase();
diff --git a/userfiles/modules/microweber/api/api_settings.js b/userfiles/modules/microweber/api/api_settings.js
index 7aebf147e86..0623eef4d19 100644
--- a/userfiles/modules/microweber/api/api_settings.js
+++ b/userfiles/modules/microweber/api/api_settings.js
@@ -336,6 +336,11 @@
                 mw.require(mw.settings.libs_url + 'multilanguage' + '/mlTextArea.js');
             }
         ],
+        xss: [
+            function () {
+                mw.require(mw.settings.libs_url + 'xss' + '/xss.min.js');
+            }
+        ],
         codemirror: [
             function () {
                 mw.require(mw.settings.libs_url + 'codemirror' + '/codemirror.min.js');