Fixed: Html escaping missing for portalPageId parameter of Help button (OFBIZ-10828) Thanks, Niels Heinen of the Google security team for reporting the issue.