diff --git src/wp-admin/menu-header.php src/wp-admin/menu-header.php
index c599fd1..59333e3 100644
--- src/wp-admin/menu-header.php
+++ src/wp-admin/menu-header.php
@@ -127,9 +127,11 @@ function _wp_menu_output( $menu, $submenu, $submenu_as_parent = true ) {
 				$menu_file = substr( $menu_file, 0, $pos );
 			if ( ! empty( $menu_hook ) || ( ( 'index.php' != $submenu_items[0][2] ) && file_exists( WP_PLUGIN_DIR . "/$menu_file" ) && ! file_exists( ABSPATH . "/wp-admin/$menu_file" ) ) ) {
 				$admin_is_parent = true;
-				echo "<a href='admin.php?page={$submenu_items[0][2]}'$class $aria_attributes>$arrow<div class='wp-menu-image$img_class'$img_style>$img</div><div class='wp-menu-name'>$title</div></a>";
+				$href = esc_url( admin_url( "admin.php?page={$submenu_items[0][2]}" ) );
+				echo "<a href='$href'$class $aria_attributes>$arrow<div class='wp-menu-image$img_class'$img_style>$img</div><div class='wp-menu-name'>$title</div></a>";
 			} else {
-				echo "\n\t<a href='{$submenu_items[0][2]}'$class $aria_attributes>$arrow<div class='wp-menu-image$img_class'$img_style>$img</div><div class='wp-menu-name'>$title</div></a>";
+				$href = esc_url( $submenu_items[0][2] );
+				echo "\n\t<a href='{$href}'$class $aria_attributes>$arrow<div class='wp-menu-image$img_class'$img_style>$img</div><div class='wp-menu-name'>$title</div></a>";
 			}
 		} elseif ( ! empty( $item[2] ) && current_user_can( $item[1] ) ) {
 			$menu_hook = get_plugin_page_hook( $item[2], 'admin.php' );
@@ -138,9 +140,15 @@ function _wp_menu_output( $menu, $submenu, $submenu_as_parent = true ) {
 				$menu_file = substr( $menu_file, 0, $pos );
 			if ( ! empty( $menu_hook ) || ( ( 'index.php' != $item[2] ) && file_exists( WP_PLUGIN_DIR . "/$menu_file" ) && ! file_exists( ABSPATH . "/wp-admin/$menu_file" ) ) ) {
 				$admin_is_parent = true;
-				echo "\n\t<a href='admin.php?page={$item[2]}'$class $aria_attributes>$arrow<div class='wp-menu-image$img_class'$img_style>$img</div><div class='wp-menu-name'>{$item[0]}</div></a>";
+				$href = esc_url( admin_url( "admin.php?page={$item[2]}" ) );
+				echo "\n\t<a href='$href'$class $aria_attributes>$arrow<div class='wp-menu-image$img_class'$img_style>$img</div><div class='wp-menu-name'>{$item[0]}</div></a>";
 			} else {
-				echo "\n\t<a href='{$item[2]}'$class $aria_attributes>$arrow<div class='wp-menu-image$img_class'$img_style>$img</div><div class='wp-menu-name'>{$item[0]}</div></a>";
+				$href = $item[2];
+				if ( ! preg_match( '#^/|^https?:#', $href ) ) {
+					$href = admin_url( $href );
+				}
+				$href = esc_url( $href );
+				echo "\n\t<a href='{$href}'$class $aria_attributes>$arrow<div class='wp-menu-image$img_class'$img_style>$img</div><div class='wp-menu-name'>{$item[0]}</div></a>";
 			}
 		}
 
@@ -200,12 +208,15 @@ function _wp_menu_output( $menu, $submenu, $submenu_as_parent = true ) {
 						$sub_item_url = add_query_arg( array( 'page' => $sub_item[2] ), $item[2] );
 					else
 						$sub_item_url = add_query_arg( array( 'page' => $sub_item[2] ), 'admin.php' );
-
-					$sub_item_url = esc_url( $sub_item_url );
-					echo "<li$class><a href='$sub_item_url'$class>$title</a></li>";
 				} else {
-					echo "<li$class><a href='{$sub_item[2]}'$class>$title</a></li>";
+					$sub_item_url = $sub_item[2];
+				}
+
+				if ( ! preg_match( '#^/|^https?:#', $sub_item_url ) ) {
+					$sub_item_url = admin_url( $sub_item_url );
 				}
+				$sub_item_url = esc_url( $sub_item_url );
+				echo "<li$class><a href='$sub_item_url'$class>$title</a></li>";
 			}
 			echo "</ul>";
 		}