diff --git a/includes/admin/importers/class-sp-importer.php b/includes/admin/importers/class-sp-importer.php
index 9c2568ce..78c91b96 100644
--- a/includes/admin/importers/class-sp-importer.php
+++ b/includes/admin/importers/class-sp-importer.php
@@ -231,7 +231,7 @@ if ( class_exists( 'WP_Importer' ) ) {
 
 				if ( file_exists( ABSPATH . $_POST['file_url'] ) ) {
 
-					$this->file_url = esc_attr( $_POST['file_url'] );
+					$this->file_url = sanitize_url( $_POST['file_url'] );
 
 				} else {
 
diff --git a/includes/admin/post-types/class-sp-admin-cpt-event.php b/includes/admin/post-types/class-sp-admin-cpt-event.php
index 02236359..cd33a221 100644
--- a/includes/admin/post-types/class-sp-admin-cpt-event.php
+++ b/includes/admin/post-types/class-sp-admin-cpt-event.php
@@ -262,7 +262,7 @@ class SP_Admin_CPT_Event extends SP_Admin_CPT {
 	    if ( $typenow != 'sp_event' )
 	    	return;
 
-		$selected = isset( $_REQUEST['team'] ) ? esc_attr( $_REQUEST['team'] ) : null;
+		$selected = isset( $_REQUEST['team'] ) ? sanitize_key( $_REQUEST['team'] ) : null;
 		$args = array(
 			'post_type' => 'sp_team',
 			'name' => 'team',
@@ -272,7 +272,7 @@ class SP_Admin_CPT_Event extends SP_Admin_CPT {
 		);
 		wp_dropdown_pages( $args );
 
-		$selected = isset( $_REQUEST['sp_league'] ) ? esc_attr( $_REQUEST['sp_league'] ) : null;
+		$selected = isset( $_REQUEST['sp_league'] ) ? sanitize_key( $_REQUEST['sp_league'] ) : null;
 		$args = array(
 			'show_option_all' =>  __( 'Show all leagues', 'sportspress' ),
 			'taxonomy' => 'sp_league',
@@ -281,7 +281,7 @@ class SP_Admin_CPT_Event extends SP_Admin_CPT {
 		);
 		sp_dropdown_taxonomies( $args );
 
-		$selected = isset( $_REQUEST['sp_season'] ) ? esc_attr( $_REQUEST['sp_season'] ) : null;
+		$selected = isset( $_REQUEST['sp_season'] ) ? sanitize_key( $_REQUEST['sp_season'] ) : null;
 		$args = array(
 			'show_option_all' =>  __( 'Show all seasons', 'sportspress' ),
 			'taxonomy' => 'sp_season',
@@ -290,7 +290,7 @@ class SP_Admin_CPT_Event extends SP_Admin_CPT {
 		);
 		sp_dropdown_taxonomies( $args );
 
-		$selected = isset( $_REQUEST['match_day'] ) ? esc_attr( $_REQUEST['match_day'] ) : null;
+		$selected = isset( $_REQUEST['match_day'] ) ? sanitize_text_field( $_REQUEST['match_day'] ) : null;
 		echo '<input name="match_day" type="text" class="sp-tablenav-input" placeholder="' . __( 'Match Day', 'sportspress' ) . '" value="' . $selected . '">';
 
 		if ( current_user_can( 'edit_others_sp_events' ) )
diff --git a/includes/admin/settings/class-sp-settings-modules.php b/includes/admin/settings/class-sp-settings-modules.php
index 6f76ccdc..7725c669 100644
--- a/includes/admin/settings/class-sp-settings-modules.php
+++ b/includes/admin/settings/class-sp-settings-modules.php
@@ -222,8 +222,8 @@ class SP_Settings_Modules extends SP_Settings_Page {
 							<tr class="sp-module-unavailable"><td>
 								<input type="checkbox" disabled="disabled">
 								<span class="sp-desc-tip" title="<?php echo sp_array_value( $module, 'tip', __( 'Upgrade to Pro', 'sportspress' ) ); ?>">
-									<i class="<?php echo sp_array_value( $module, 'icon', 'dashicons dashicons-admin-generic' ); ?>"></i>
-									<?php echo sp_array_value( $module, 'label', $id ); ?>
+									<i class="<?php echo esc_attr( sp_array_value( $module, 'icon', 'dashicons dashicons-admin-generic' ) ); ?>"></i>
+									<?php echo esc_html( sp_array_value( $module, 'label', $id ) ); ?>
 								</span>
 								<?php if ( isset( $module['desc'] ) ) { ?>
 									<span class="sp-desc">
diff --git a/includes/sp-template-functions.php b/includes/sp-template-functions.php
index 66c84c0b..15b50ae7 100644
--- a/includes/sp-template-functions.php
+++ b/includes/sp-template-functions.php
@@ -86,7 +86,7 @@ if ( ! function_exists( 'sportspress_taxonomy_archive_description' ) ) {
 		if ( is_tax( array( 'sp_season', 'sp_league', 'sp_venue', 'sp_position' ) ) && get_query_var( 'paged' ) == 0 ) {
 			$description = apply_filters( 'the_content', term_description() );
 			if ( $description ) {
-				echo '<div class="term-description">' . $description . '</div>';
+				echo '<div class="term-description">' . esc_html( $description ) . '</div>';
 			}
 		}
 	}