diff --git a/readme.txt b/readme.txt
index 663970b68..df6e231b5 100644
--- a/readme.txt
+++ b/readme.txt
@@ -265,6 +265,7 @@ You can report security bugs through the Patchstack Vulnerability Disclosure Pro
 
 = 6.5.1 - Sep 25 2024 =
 * **Media** Sanitized dimensions for the images when replacing with placeholders. (TaiYou)
+* **Page Optimize** Sanitized vary value in queue list. (TaiYou)
 * **Cloud** Silent API error when failing to retrieve news updates.
 
 = 6.5.0.2 - Sep 6 2024 =
diff --git a/tpl/page_optm/settings_css.tpl.php b/tpl/page_optm/settings_css.tpl.php
index f34aabd28..2a0aaca1e 100644
--- a/tpl/page_optm/settings_css.tpl.php
+++ b/tpl/page_optm/settings_css.tpl.php
@@ -118,7 +118,7 @@
 									<?php if (!empty($v['_status'])) : ?><span class="litespeed-success"><?php endif; ?>
 										<?php echo esc_html($v['url']); ?>
 										<?php if (!empty($v['_status'])) : ?></span><?php endif; ?>
-									<?php if ($pos = strpos($k, ' ')) echo ' (' . __('Vary Group', 'litespeed-cache') . ':' . substr($k, 0, $pos) . ')'; ?>
+									<?php if ($pos = strpos($k, ' ')) echo ' (' . __('Vary Group', 'litespeed-cache') . ':' . esc_html(substr($k, 0, $pos)) . ')'; ?>
 									<?php if ($v['is_mobile']) echo ' <span data-balloon-pos="up" aria-label="mobile">📱</span>'; ?>
 									<?php if (!empty($v['is_webp'])) echo ' WebP'; ?>
 									<br />
@@ -235,7 +235,7 @@
 									<?php if (!empty($v['_status'])) : ?><span class="litespeed-success"><?php endif; ?>
 										<?php echo esc_html($v['url']); ?>
 										<?php if (!empty($v['_status'])) : ?></span><?php endif; ?>
-									<?php if ($pos = strpos($k, ' ')) echo ' (' . __('Vary Group', 'litespeed-cache') . ':' . substr($k, 0, $pos) . ')'; ?>
+									<?php if ($pos = strpos($k, ' ')) echo ' (' . __('Vary Group', 'litespeed-cache') . ':' . esc_html(substr($k, 0, $pos)) . ')'; ?>
 									<?php if ($v['is_mobile']) echo ' <span data-balloon-pos="up" aria-label="mobile">📱</span>'; ?>
 									<?php if (!empty($v['is_webp'])) echo ' WebP'; ?>
 									<br />
diff --git a/tpl/page_optm/settings_vpi.tpl.php b/tpl/page_optm/settings_vpi.tpl.php
index 2c9f75848..4e4023468 100644
--- a/tpl/page_optm/settings_vpi.tpl.php
+++ b/tpl/page_optm/settings_vpi.tpl.php
@@ -64,7 +64,7 @@
 							<?php if ( ! empty( $v[ '_status' ] ) ) : ?><span class="litespeed-success"><?php endif; ?>
 							<?php echo esc_html( $v[ 'url' ] ); ?>
 							<?php if ( ! empty( $v[ '_status' ] ) ) : ?></span><?php endif; ?>
-							<?php if ( $pos = strpos( $k, ' ' ) ) echo ' (' . __( 'Vary Group', 'litespeed-cache' ) . ':' . substr( $k, 0, $pos ) . ')'; ?>
+							<?php if ( $pos = strpos( $k, ' ' ) ) echo ' (' . __( 'Vary Group', 'litespeed-cache' ) . ':' . esc_html( substr( $k, 0, $pos ) ) . ')'; ?>
 							<?php if ( $v[ 'is_mobile' ] ) echo ' <span data-balloon-pos="up" aria-label="mobile">📱</span>'; ?>
 							<br />
 						<?php endforeach; ?>