diff --git a/src/wp-includes/option.php b/src/wp-includes/option.php
index 9952514733..ea9ff56d4e 100644
--- a/src/wp-includes/option.php
+++ b/src/wp-includes/option.php
@@ -1115,7 +1115,7 @@ function wp_user_settings() {
 	$settings = (string) get_user_option( 'user-settings', $user_id );
 
 	if ( isset( $_COOKIE[ 'wp-settings-' . $user_id ] ) ) {
-		$cookie = preg_replace( '/[^A-Za-z0-9=&_]/', '', $_COOKIE[ 'wp-settings-' . $user_id ] );
+		$cookie = preg_replace( '/[^A-Za-z0-9=&_]/', '', sanitize_text_field( $_COOKIE[ 'wp-settings-' . $user_id ] ) );
 
 		// No change or both empty.
 		if ( $cookie == $settings ) {