diff --git a/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/plugin/CrossSiteScriptingLesson3.java b/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/plugin/CrossSiteScriptingLesson3.java
index d6c65fec0..c14e125f1 100644
--- a/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/plugin/CrossSiteScriptingLesson3.java
+++ b/webgoat-lessons/cross-site-scripting/src/main/java/org/owasp/webgoat/plugin/CrossSiteScriptingLesson3.java
@@ -28,6 +28,7 @@ public class CrossSiteScriptingLesson3 extends AssignmentEndpoint {
     public AttackResult completed(@RequestParam String editor) {
         //https://github.com/OWASP/owasp-java-encoder
         //maybe better idea for assignment
+        //<e:forHtml value="${param.title}" />
 
         String line1 ="";
         String line2 ="";
diff --git a/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/plugin/SecurePasswordsAssignment.java b/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/plugin/SecurePasswordsAssignment.java
index 071befc49..fbbe4d29f 100644
--- a/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/plugin/SecurePasswordsAssignment.java
+++ b/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/plugin/SecurePasswordsAssignment.java
@@ -42,7 +42,14 @@ public class SecurePasswordsAssignment extends AssignmentEndpoint {
         output.append("<b>Your Password: </b>" + password + "</br>");
         output.append("<b>Length: </b>" + password.length()+ "</br>");
         output.append("<b>Estimated guesses needed to crack your password: </b>" + df.format(strength.getGuesses())+ "</br>");
-        output.append("<b>Score: </b>" + strength.getScore()+ "/5 </br>");
+        output.append("<b>Score: </b>" + strength.getScore()+ "/5");
+        if(strength.getScore()<=1){
+            output.append("<div style=\"background-color:red;width: 200px;\">&nbsp;</div></br>");
+        } else if(strength.getScore()<=3){
+            output.append("<div style=\"background-color:orange;width: 200px;\">&nbsp;</div></br>");
+        } else{
+            output.append("<div style=\"background-color:green;width: 200px;\">&nbsp;</div></br>");
+        }
         output.append("<b>Estimated cracking time in seconds: </b>" + calculateTime((long) strength.getCrackTimeSeconds().getOnlineNoThrottling10perSecond()));
 
         if(strength.getScore() >= 4)