diff --git a/public/themes/material-blue/views/_partials/fixed-header.inc b/public/themes/material-blue/views/_partials/fixed-header.inc
index 4b4bd9a82..b607e2819 100644
--- a/public/themes/material-blue/views/_partials/fixed-header.inc
+++ b/public/themes/material-blue/views/_partials/fixed-header.inc
@@ -34,7 +34,7 @@ use function SP\__;
                         <a id="btn-<?php echo $action->getId(); ?>"
                            class="btn-menu mdl-navigation__link"
                             <?php foreach ($action->getData() as $dataName => $dataValue): ?>
-                                <?php echo 'data-', $dataName, '="', $dataValue, '"'; ?>
+                                <?php echo 'data-', $dataName, '="', $_e($dataValue), '"'; ?>
                             <?php endforeach; ?>>
                             <i class="material-icons"><?php echo $action->getIcon()->getIcon(); ?></i>
                         </a>
@@ -102,7 +102,7 @@ use function SP\__;
                     <a id="btn-drawer-<?php echo $action->getId(); ?>"
                        class="btn-menu mdl-navigation__link"
                         <?php foreach ($action->getData() as $dataName => $dataValue): ?>
-                            <?php echo 'data-', $dataName, '="', $dataValue, '"'; ?>
+                            <?php echo 'data-', $dataName, '="', $_e($dataValue), '"'; ?>
                         <?php endforeach; ?>>
                         <i class="material-icons"><?php echo $action->getIcon()->getIcon(); ?></i>
                         <?php echo $_e($action->getTitle()); ?>
diff --git a/public/themes/material-blue/views/account/search-rows.inc b/public/themes/material-blue/views/account/search-rows.inc
index 88334971b..a1fe8710e 100644
--- a/public/themes/material-blue/views/account/search-rows.inc
+++ b/public/themes/material-blue/views/account/search-rows.inc
@@ -421,8 +421,14 @@ $favoriteRouteOff = $_getvar('favoriteRouteOff');
                                data-parent-id="<?php
                                echo $accountSearchData->getParentId(); ?>"
                                 <?php
+                                // A data attribute is escaped like every other value the theme
+                                // renders. These loops emit whatever a grid action was given, and
+                                // what reaches them today is routes and integer ids — but nothing
+                                // here constrains that, and the escaping guard cannot see a bare
+                                // `$dataValue` the way it sees a named getter. One `addData()` call
+                                // carrying a name or a note would break out of the attribute.
                                 foreach ($action->getData() as $dataName => $dataValue):
-                                    printf('data-%s="%s"', $dataName, $dataValue);
+                                    printf('data-%s="%s"', $dataName, $_e($dataValue));
                                 endforeach; ?>>
                                 <?php
                                 echo $action->getIcon()->getIcon(); ?></i>
@@ -459,7 +465,7 @@ $favoriteRouteOff = $_getvar('favoriteRouteOff');
                                             echo $accountSearchData->getParentId(); ?>"
                                             <?php
                                             foreach ($actionMenu->getData() as $dataName => $dataValue):
-                                                printf('data-%s="%s"', $dataName, $dataValue);
+                                                printf('data-%s="%s"', $dataName, $_e($dataValue));
                                             endforeach; ?>>
                                             <i class="material-icons <?php
                                             echo $actionMenu->getIcon()->getClass(); ?>"
diff --git a/public/themes/material-blue/views/grid/datagrid-grid.inc b/public/themes/material-blue/views/grid/datagrid-grid.inc
index 4ddb435b5..3e2aeae18 100644
--- a/public/themes/material-blue/views/grid/datagrid-grid.inc
+++ b/public/themes/material-blue/views/grid/datagrid-grid.inc
@@ -64,7 +64,7 @@ $index = $index ?? 0;
                         <?php
                         foreach (
                             $action->getData() as $dataName => $dataValue
-                        ): echo 'data-', $dataName, '=', '"', $dataValue, '"'; endforeach; ?>>
+                        ): echo 'data-', $dataName, '=', '"', $_e($dataValue), '"'; endforeach; ?>>
                         <i class="material-icons"><?php
                             echo $action->getIcon()->getIcon(); ?></i>
                     </button>
@@ -90,7 +90,7 @@ $index = $index ?? 0;
                         <?php
                         foreach (
                             $action->getData() as $dataName => $dataValue
-                        ): echo 'data-', $dataName, '=', '"', $dataValue, '"'; endforeach; ?>>
+                        ): echo 'data-', $dataName, '=', '"', $_e($dataValue), '"'; endforeach; ?>>
 
                         <div class="mdl-textfield mdl-js-textfield mdl-textfield--expandable">
                             <label class="mdl-button mdl-js-button mdl-button--icon"
@@ -194,7 +194,7 @@ $index = $index ?? 0;
                             <?php
                             foreach (
                                 $action->getData() as $dataName => $dataValue
-                            ): echo 'data-', $dataName, '=', '"', $dataValue, '"'; endforeach; ?>>
+                            ): echo 'data-', $dataName, '=', '"', $_e($dataValue), '"'; endforeach; ?>>
                             <i class="material-icons <?php
                             echo $action->getIcon()->getClass(); ?>"><?php
                                 echo $action->getIcon()->getIcon(); ?></i>
diff --git a/public/themes/material-blue/views/grid/datagrid-rows.inc b/public/themes/material-blue/views/grid/datagrid-rows.inc
index 64812acab..6785144d8 100644
--- a/public/themes/material-blue/views/grid/datagrid-rows.inc
+++ b/public/themes/material-blue/views/grid/datagrid-rows.inc
@@ -103,10 +103,14 @@ if ($dataGridData->getDataCount() > 0):
                                    data-item-id="<?php
                                    echo $itemId; ?>"
                                    data-onclick="<?php
-                                   echo $action->getOnClick(); ?>"
+                                   echo $_e($action->getOnClick()); ?>"
                                     <?php
+                                    // Escaped like every other value the theme renders. What
+                                    // reaches these today is routes and integer ids, but nothing
+                                    // here constrains that, and the escaping guard cannot see a
+                                    // bare `$dataValue` the way it sees a named getter.
                                     foreach ($nodeData as $dataName => $dataValue):
-                                        echo 'data-', $dataName, '=', '"', $dataValue, '"';
+                                        echo 'data-', $dataName, '=', '"', $_e($dataValue), '"';
                                     endforeach; ?>><?php
                                     echo $action->getIcon()->getIcon(); ?></i>
                                 <span
diff --git a/tests/Unit/Infrastructure/Adapter/In/Web/View/ThemeEscapesWhatItRendersTest.php b/tests/Unit/Infrastructure/Adapter/In/Web/View/ThemeEscapesWhatItRendersTest.php
index 9962665e2..fbda467b6 100644
--- a/tests/Unit/Infrastructure/Adapter/In/Web/View/ThemeEscapesWhatItRendersTest.php
+++ b/tests/Unit/Infrastructure/Adapter/In/Web/View/ThemeEscapesWhatItRendersTest.php
@@ -112,6 +112,62 @@ public function aTemplateEscapesTheTextItRenders(string $template): void
         self::assertSame([], $unescaped, "unescaped text in template:\n" . implode("\n", $unescaped));
     }
 
+    /**
+     * A `data-*` attribute built from a caller-supplied map escapes what it emits.
+     *
+     * The rule above is per *expression*, and it recognises what carries text by the getter's name
+     * or by `$_getvar(`. Three loops in the theme emit `data-<name>="<value>"` out of
+     * `DataGridAction::getData()` / `getRuntimeData()`, where the value is a bare `$dataValue` —
+     * invisible to that rule, and unescaped. What reaches them today is routes and integer ids, so
+     * nothing was leaking; but nothing in the templates or in `DataGridActionBase` constrains it,
+     * and a single `addData()` call carrying a name, a login or a note would break straight out of
+     * the attribute.
+     *
+     * This is narrower than the rule above on purpose: it looks only at the loops whose attribute
+     * *name* is itself a variable, which are exactly the ones taking an arbitrary map from a
+     * caller. A fixed `data-item-id="<?php echo $id; ?>"` is an id by construction and is left to
+     * the rule above.
+     */
+    #[Test]
+    #[DataProvider('templates')]
+    public function aDataAttributeMapIsEscaped(string $template): void
+    {
+        $source = (string)file_get_contents($template);
+
+        $unescaped = [];
+
+        // printf('data-%s="%s"', $name, $value) and echo 'data-', $name, '=', '"', $value, '"'
+        // The quote characters are matched with `.` rather than written into the class, which
+        // keeps this pattern readable inside a single-quoted PHP string.
+        $patterns = [
+            '/printf\(\s*.data-%s="%s".\s*,(?P<args>[^;]*?)\);/s',
+            '/echo\s+.data-.\s*,(?P<args>[^;]*?);/s',
+        ];
+
+        foreach ($patterns as $pattern) {
+            preg_match_all($pattern, $source, $matches, PREG_OFFSET_CAPTURE);
+
+            foreach ($matches['args'] as [$args, $offset]) {
+                if (str_contains($args, '$_e(')) {
+                    continue;
+                }
+
+                $unescaped[] = sprintf(
+                    '%s:%d  %s',
+                    basename($template),
+                    substr_count(substr($source, 0, $offset), "\n") + 1,
+                    trim(preg_replace('/\s+/', ' ', $args))
+                );
+            }
+        }
+
+        self::assertSame(
+            [],
+            $unescaped,
+            "a data attribute built from a caller-supplied map went out unescaped:\n" . implode("\n", $unescaped)
+        );
+    }
+
     /**
      * Inside a `<script>` element the rule is different, and `$_e()` is the wrong answer.
      *