Titles and descriptions read from hooks not properly escaped

Some values retrieved from hooks and displayed on administrative forms are not properly escaped. This is not a security issue since the data is more or less trusted and not user generated, but it still should be escaped to adhere to best practices.