diff --git a/src/wp-activate.php b/src/wp-activate.php
index ff71779036..2016fafe30 100644
--- a/src/wp-activate.php
+++ b/src/wp-activate.php
@@ -127,7 +127,7 @@ $blog_details = get_blog_details();
 	<?php if ( ! $key ) { ?>
 
 		<h2><?php _e( 'Activation Key Required' ); ?></h2>
-		<form name="activateform" id="activateform" method="post" action="<?php echo network_site_url( $blog_details->path . 'wp-activate.php' ); ?>">
+		<form name="activateform" id="activateform" method="post" action="<?php echo esc_url( network_site_url( $blog_details->path . 'wp-activate.php' ) ); ?>">
 			<p>
 				<label for="key"><?php _e( 'Activation Key:' ); ?></label>
 				<br /><input type="text" name="key" id="key" value="" size="50" />
@@ -179,8 +179,8 @@ $blog_details = get_blog_details();
 			<h2><?php _e( 'Your account is now active!' ); ?></h2>
 
 			<div id="signup-welcome">
-			<p><span class="h3"><?php _e( 'Username:' ); ?></span> <?php echo $user->user_login; ?></p>
-			<p><span class="h3"><?php _e( 'Password:' ); ?></span> <?php echo $result['password']; ?></p>
+			<p><span class="h3"><?php _e( 'Username:' ); ?></span> <?php esc_html_e( $user->user_login ); ?></p>
+			<p><span class="h3"><?php _e( 'Password:' ); ?></span> <?php esc_html_e( $result['password'] ); ?></p>
 			</div>
 
 			<?php
diff --git a/src/wp-links-opml.php b/src/wp-links-opml.php
index 9739a9a767..95b3926786 100644
--- a/src/wp-links-opml.php
+++ b/src/wp-links-opml.php
@@ -33,7 +33,7 @@ echo '<?xml version="1.0"?' . ">\n";
 			printf( __( 'Links for %s' ), esc_attr( get_bloginfo( 'name', 'display' ) ) );
 		?>
 		</title>
-		<dateCreated><?php echo gmdate( 'D, d M Y H:i:s' ); ?> GMT</dateCreated>
+		<dateCreated><?php esc_html_e( gmdate( 'D, d M Y H:i:s' ) ); ?> GMT</dateCreated>
 		<?php
 		/**
 		 * Fires in the OPML header.
@@ -83,7 +83,7 @@ foreach ( (array) $cats as $cat ) :
 <outline text="<?php echo esc_attr( $title ); ?>" type="link" xmlUrl="<?php echo esc_attr( $bookmark->link_rss ); ?>" htmlUrl="<?php echo esc_attr( $bookmark->link_url ); ?>" updated="
 							<?php
 							if ( '0000-00-00 00:00:00' !== $bookmark->link_updated ) {
-								echo $bookmark->link_updated;}
+								esc_html_e( $bookmark->link_updated );}
 							?>
 " />
 		<?php
diff --git a/src/wp-login.php b/src/wp-login.php
index b7c14b4c83..8d9781cca7 100644
--- a/src/wp-login.php
+++ b/src/wp-login.php
@@ -90,7 +90,7 @@ function login_header( $title = 'Log In', $message = '', $wp_error = null ) {
 	<html <?php language_attributes(); ?>>
 	<head>
 	<meta http-equiv="Content-Type" content="<?php bloginfo( 'html_type' ); ?>; charset=<?php bloginfo( 'charset' ); ?>" />
-	<title><?php echo $login_title; ?></title>
+	<title><?php esc_html_e( $login_title ); ?></title>
 	<?php
 
 	wp_enqueue_style( 'login' );
@@ -206,7 +206,7 @@ function login_header( $title = 'Log In', $message = '', $wp_error = null ) {
 
 	?>
 	<div id="login">
-		<h1><a href="<?php echo esc_url( $login_header_url ); ?>"><?php echo $login_header_text; ?></a></h1>
+		<h1><a href="<?php echo esc_url( $login_header_url ); ?>"><?php esc_html_e( $login_header_text ); ?></a></h1>
 	<?php
 	/**
 	 * Filters the message to display above the login form.
