diff --git src/bp-activity/bp-activity-template.php src/bp-activity/bp-activity-template.php
index 6c5ea1f..c8c0ac7 100644
--- src/bp-activity/bp-activity-template.php
+++ src/bp-activity/bp-activity-template.php
@@ -589,7 +589,7 @@ function bp_has_activities( $args = '' ) {
 	}
 
 	if ( empty( $search_terms ) && ! empty( $_REQUEST['s'] ) )
-		$search_terms = $_REQUEST['s'];
+		$search_terms = htmlentities2( $_REQUEST['s'] );
 
 	// If you have passed a "scope" then this will override any filters you have passed.
 	if ( 'just-me' == $scope || 'friends' == $scope || 'groups' == $scope || 'favorites' == $scope || 'mentions' == $scope ) {