[#6937] Fix Persistent/Reflected XSS in User Messaging

(cherry picked from commit 74a9f75b8857d4dbe98f38617c359ee8202c9eff)
[#10043] Fix class-loading LFI in registerLogging

(cherry picked from commit a04d19325ab3dfd8fdc4242f64c2e10cc14d0034)