OK, I found it. Changes in Wayfinder:
Previous code:
$phArray = array($useSub,$useClass,$classNames,$resource['link'],$resource['title'],$resource['linktext'],$useId,$resource['alias'],$resource['link_attributes'],$resource['id'],$resource['introtext'],$resource['description'],$numChildren);
New version:
$phArray = array($useSub,$useClass,$classNames,$resource['link'],htmlentities($resource['title'], ENT_COMPAT, $charset),htmlentities($resource['linktext'], ENT_COMPAT, $charset),$useId,$resource['alias'],$resource['link_attributes'],$resource['id'],htmlentities($resource['introtext'], ENT_COMPAT, $charset),htmlentities($resource['description'], ENT_COMPAT, $charset),$numChildren);