diff --git a/src/wp-includes/formatting.php b/src/wp-includes/formatting.php
index 8c77d167a4..86754dc27b 100644
--- a/src/wp-includes/formatting.php
+++ b/src/wp-includes/formatting.php
@@ -4734,6 +4734,16 @@ function esc_textarea( $text ) {
 function esc_xml( $text ) {
 	$safe_text = wp_check_invalid_utf8( $text );
 
+	// Strip invalid XML characters.
+	$is_utf8 = in_array( get_option( 'blog_charset' ), array( 'utf8', 'utf-8', 'UTF8', 'UTF-8' ) );
+	if ( $is_utf8 ) {
+		$safe_text = preg_replace(
+			'/[^\x{9}\x{A}\x{D}\x{20}-\x{D7FF}\x{E000}-\x{FFFD}\x{10000}-\x{10FFFF}]/u',
+			'',
+			$safe_text
+		);
+	}
+
 	$cdata_regex = '\<\!\[CDATA\[.*?\]\]\>';
 	$regex       = <<<EOF
 /