Escape titles in Flex pages list (flex-objects#84)

CHANGELOG.md

@@ -29,6 +29,7 @@
     * Fixed potential fatal error when creating flex index using cache [#3062](https://github.com/getgrav/grav/issues/3062)
     * Fixed fatal error in `CompiledFile` if the cached version is broken
     * Fixed updated media missing from media when editing Flex Object after page reload
+    * Escape titles in Flex pages list [flex-objects#84](https://github.com/trilbymedia/grav-plugin-flex-objects/issues/84)
 
 # v1.7.0-rc.17
 ## 10/07/2020

system/src/Grav/Common/Flex/Types/Pages/PageIndex.php

@@ -489,7 +489,7 @@ class PageIndex extends FlexPageIndex implements PageCollectionInterface
                     $payload = [
                         'item-key' => basename($child->rawRoute() ?? $child->getKey()),
                         'icon' => $icon,
-                        'title' => $child->menu(),
+                        'title' => htmlspecialchars($child->menu()),
                         'route' => [
                             'display' => $child->getRoute()->toString(false) ?: '/',
                             'raw' => $child->rawRoute(),