diff --git src/wp-includes/author-template.php src/wp-includes/author-template.php
index 4c4ea32..1d6b1df 100644
--- src/wp-includes/author-template.php
+++ src/wp-includes/author-template.php
@@ -472,7 +472,7 @@ function wp_list_authors( $args = '' ) {
 
 		$link = sprintf(
 			'<a href="%1$s" title="%2$s">%3$s</a>',
-			get_author_posts_url( $author->ID, $author->user_nicename ),
+			esc_url( get_author_posts_url( $author->ID, $author->user_nicename ) ),
 			/* translators: %s: author's display name */
 			esc_attr( sprintf( __( 'Posts by %s' ), $author->display_name ) ),
 			$name
@@ -484,7 +484,7 @@ function wp_list_authors( $args = '' ) {
 				$link .= '(';
 			}
 
-			$link .= '<a href="' . get_author_feed_link( $author->ID, $args['feed_type'] ) . '"';
+			$link .= '<a href="' . esc_url( get_author_feed_link( $author->ID, $args['feed_type'] ) ) . '"';
 
 			$alt = '';
 			if ( ! empty( $args['feed'] ) ) {