perform some text filtering on plugin titles

I believe both of these come from hard-coded places, so if they are xss then the exploit vector includes the ability to write plugin code which means...you are already in trouble

That said, there's no reason I could find to simply include plugin titles without some form of filtering just in case. These should be plain text rendered to a browser as plain text.