diff --git src/wp-admin/includes/class-custom-background.php src/wp-admin/includes/class-custom-background.php
index 8027c6a2ce..ac9aaadff5 100644
--- src/wp-admin/includes/class-custom-background.php
+++ src/wp-admin/includes/class-custom-background.php
@@ -310,8 +310,8 @@ class Custom_Background {
 			?>
 	<div id="custom-background-image" style="<?php echo $background_styles; ?>"><?php // Must be double quote, see above. ?>
 			<?php if ( $background_image_thumb ) { ?>
-		<img class="custom-background-image" src="<?php echo $background_image_thumb; ?>" style="visibility:hidden;" alt="" /><br />
-		<img class="custom-background-image" src="<?php echo $background_image_thumb; ?>" style="visibility:hidden;" alt="" />
+		<img class="custom-background-image" src="<?php echo esc_url( $background_image_thumb ); ?>" style="visibility:hidden;" alt="" /><br />
+		<img class="custom-background-image" src="<?php echo esc_url( $background_image_thumb ); ?>" style="visibility:hidden;" alt="" />
 		<?php } ?>
 	</div>
 	<?php } ?>
@@ -443,7 +443,7 @@ class Custom_Background {
 		<label>
 			<input class="ui-helper-hidden-accessible" name="background-position" type="radio" value="<?php echo esc_attr( $value ); ?>"<?php checked( $value, $background_position ); ?>>
 			<span class="button display-options position"><span class="<?php echo esc_attr( $input['icon'] ); ?>" aria-hidden="true"></span></span>
-			<span class="screen-reader-text"><?php echo $input['label']; ?></span>
+			<span class="screen-reader-text"><?php echo esc_html( $input['label'] ); ?></span>
 		</label>
 	<?php endforeach; ?>
 	</div>
diff --git src/wp-admin/includes/class-wp-privacy-policy-content.php src/wp-admin/includes/class-wp-privacy-policy-content.php
index 16fe3a689a..978ee396ee 100644
--- src/wp-admin/includes/class-wp-privacy-policy-content.php
+++ src/wp-admin/includes/class-wp-privacy-policy-content.php
@@ -411,18 +411,18 @@ final class WP_Privacy_Policy_Content {
 			$plugin_name = esc_html( $section['plugin_name'] );
 			?>
 			<h4 class="privacy-settings-accordion-heading">
-				<button aria-expanded="false" class="privacy-settings-accordion-trigger" aria-controls="privacy-settings-accordion-block-<?php echo $i; ?>" type="button">
-				<span class="title"><?php echo $plugin_name; ?></span>
+				<button aria-expanded="false" class="privacy-settings-accordion-trigger" aria-controls="privacy-settings-accordion-block-<?php echo esc_attr( $i ); ?>" type="button">
+				<span class="title"><?php echo esc_html( $plugin_name ); ?></span>
 				<?php if ( ! empty( $section['removed'] ) || ! empty( $section['updated'] ) ) : ?>
-				<span class="badge <?php echo $badge_class; ?>"> <?php echo $badge_title; ?></span>
+				<span class="badge <?php echo esc_attr( $badge_class ); ?>"> <?php echo esc_html( $badge_title ); ?></span>
 				<?php endif; ?>
 				<span class="icon"></span>
 			</button>
 			</h4>
-			<div id="privacy-settings-accordion-block-<?php echo $i; ?>" class="privacy-settings-accordion-panel privacy-text-box-body" hidden="hidden">
+			<div id="privacy-settings-accordion-block-<?php echo esc_attr( $i ); ?>" class="privacy-settings-accordion-panel privacy-text-box-body" hidden="hidden">
 				<?php
-				echo $removed;
-				echo $section['policy_text'];
+				echo esc_html( $removed );
+				echo esc_html( $section['policy_text'] );
 				?>
 				<?php if ( empty( $section['removed'] ) ) : ?>
 				<div class="privacy-settings-accordion-actions">
diff --git src/wp-admin/includes/class-wp-screen.php src/wp-admin/includes/class-wp-screen.php
index 4bb5995e7f..509df4eb22 100644
--- src/wp-admin/includes/class-wp-screen.php
+++ src/wp-admin/includes/class-wp-screen.php
@@ -882,7 +882,7 @@ final class WP_Screen {
 							$panel_id = "tab-panel-{$tab['id']}";
 							?>
 
-							<li id="<?php echo esc_attr( $link_id ); ?>"<?php echo $class; ?>>
+							<li id="<?php echo esc_attr( $link_id ); ?>"<?php echo esc_html( $class ); ?>>
 								<a href="<?php echo esc_url( "#$panel_id" ); ?>" aria-controls="<?php echo esc_attr( $panel_id ); ?>">
 									<?php echo esc_html( $tab['title'] ); ?>
 								</a>
@@ -896,7 +896,7 @@ final class WP_Screen {
 
 					<?php if ( $help_sidebar ) : ?>
 					<div class="contextual-help-sidebar">
-						<?php echo $help_sidebar; ?>
+						<?php echo esc_html( $help_sidebar ); ?>
 					</div>
 					<?php endif; ?>
 
@@ -907,10 +907,10 @@ final class WP_Screen {
 							$panel_id = "tab-panel-{$tab['id']}";
 							?>
 
-							<div id="<?php echo esc_attr( $panel_id ); ?>" class="<?php echo $classes; ?>">
+							<div id="<?php echo esc_attr( $panel_id ); ?>" class="<?php echo esc_attr( $classes ); ?>">
 								<?php
 								// Print tab content.
-								echo $tab['content'];
+								echo esc_html( $tab['content'] );
 
 								// If it exists, fire tab callback.
 								if ( ! empty( $tab['callback'] ) ) {
@@ -1003,7 +1003,7 @@ final class WP_Screen {
 
 		if ( 'post' === $this->base ) {
 			$expand                 = '<fieldset class="editor-expand hidden"><legend>' . __( 'Additional settings' ) . '</legend><label for="editor-expand-toggle">';
-			$expand                .= '<input type="checkbox" id="editor-expand-toggle"' . checked( get_user_setting( 'editor_expand', 'on' ), 'on', false ) . ' />';
+			$expand                .= '<input type="checkbox" id="editor-expand-toggle" ' . checked( get_user_setting( 'editor_expand', 'on' ), 'on', false ) . ' />';
 			$expand                .= __( 'Enable full-height editor and distraction-free functionality.' ) . '</label></fieldset>';
 			$this->_screen_settings = $expand;
 		}
@@ -1134,7 +1134,7 @@ final class WP_Screen {
 				}
 			}
 			echo '<label for="wp_welcome_panel-hide">';
-			echo '<input type="checkbox" id="wp_welcome_panel-hide"' . checked( (bool) $welcome_checked, true, false ) . ' />';
+			echo '<input type="checkbox" id="wp_welcome_panel-hide" ' . checked( (bool) $welcome_checked, true, false ) . ' />';
 			echo _x( 'Welcome', 'Welcome panel' ) . "</label>\n";
 		}
 		?>
@@ -1160,7 +1160,7 @@ final class WP_Screen {
 		$legend = ! empty( $columns['_title'] ) ? $columns['_title'] : __( 'Columns' );
 		?>
 		<fieldset class="metabox-prefs">
-		<legend><?php echo $legend; ?></legend>
+		<legend><?php echo esc_html( $legend ); ?></legend>
 		<?php
 		$special = array( '_title', 'cb', 'comment', 'media', 'name', 'title', 'username', 'blogname' );
 
@@ -1183,7 +1183,7 @@ final class WP_Screen {
 
 			$id = "$column-hide";
 			echo '<label>';
-			echo '<input class="hide-column-tog" name="' . $id . '" type="checkbox" id="' . $id . '" value="' . $column . '"' . checked( ! in_array( $column, $hidden, true ), true, false ) . ' />';
+			echo '<input class="hide-column-tog" name="' . esc_attr( $id ) . '" type="checkbox" id="' . esc_attr( $id ) . '" value="' . esc_attr( $column ) . '" ' . checked( ! in_array( $column, $hidden, true ), true, false ) . ' />';
 			echo "$title</label>\n";
 		}
 		?>
@@ -1208,7 +1208,7 @@ final class WP_Screen {
 		<fieldset class='columns-prefs'>
 		<legend class="screen-layout"><?php _e( 'Layout' ); ?></legend>
 		<?php for ( $i = 1; $i <= $num; ++$i ) : ?>
-			<label class="columns-prefs-<?php echo $i; ?>">
+			<label class="columns-prefs-<?php echo esc_attr( $i ); ?>">
 			<input type='radio' name='screen_columns' value='<?php echo esc_attr( $i ); ?>' <?php checked( $screen_layout_columns, $i ); ?> />
 			<?php
 				printf(
diff --git src/wp-admin/includes/class-wp-theme-install-list-table.php src/wp-admin/includes/class-wp-theme-install-list-table.php
index 7e00005ba4..7ec8e66ad5 100644
--- src/wp-admin/includes/class-wp-theme-install-list-table.php
+++ src/wp-admin/includes/class-wp-theme-install-list-table.php
@@ -365,7 +365,7 @@ class WP_Theme_Install_List_Table extends WP_Themes_List_Table {
 			<img src="<?php echo esc_url( $theme->screenshot_url . '?ver=' . $theme->version ); ?>" width="150" alt="" />
 		</a>
 
-		<h3><?php echo $name; ?></h3>
+		<h3><?php echo esc_html( $name ); ?></h3>
 		<div class="theme-author">
 		<?php
 			/* translators: %s: Theme author. */
@@ -376,7 +376,7 @@ class WP_Theme_Install_List_Table extends WP_Themes_List_Table {
 		<div class="action-links">
 			<ul>
 				<?php foreach ( $actions as $action ) : ?>
-					<li><?php echo $action; ?></li>
+					<li><?php echo esc_html( $action ); ?></li>
 				<?php endforeach; ?>
 				<li class="hide-if-no-js"><a href="#" class="theme-detail"><?php _e( 'Details' ); ?></a></li>
 			</ul>
diff --git src/wp-admin/includes/dashboard.php src/wp-admin/includes/dashboard.php
index b198325f27..7aaebbd9d5 100644
--- src/wp-admin/includes/dashboard.php
+++ src/wp-admin/includes/dashboard.php
@@ -266,20 +266,20 @@ function wp_dashboard() {
 		$columns_css = " columns-$columns";
 	}
 	?>
-<div id="dashboard-widgets" class="metabox-holder<?php echo $columns_css; ?>">
-	<div id="postbox-container-1" class="postbox-container">
-	<?php do_meta_boxes( $screen->id, 'normal', '' ); ?>
-	</div>
-	<div id="postbox-container-2" class="postbox-container">
-	<?php do_meta_boxes( $screen->id, 'side', '' ); ?>
-	</div>
-	<div id="postbox-container-3" class="postbox-container">
-	<?php do_meta_boxes( $screen->id, 'column3', '' ); ?>
-	</div>
-	<div id="postbox-container-4" class="postbox-container">
-	<?php do_meta_boxes( $screen->id, 'column4', '' ); ?>
+	<div id="dashboard-widgets" class="metabox-holder<?php echo esc_attr( $columns_css ); ?>">
+		<div id="postbox-container-1" class="postbox-container">
+			<?php do_meta_boxes( $screen->id, 'normal', '' ); ?>
+		</div>
+		<div id="postbox-container-2" class="postbox-container">
+			<?php do_meta_boxes( $screen->id, 'side', '' ); ?>
+		</div>
+		<div id="postbox-container-3" class="postbox-container">
+			<?php do_meta_boxes( $screen->id, 'column3', '' ); ?>
+		</div>
+		<div id="postbox-container-4" class="postbox-container">
+			<?php do_meta_boxes( $screen->id, 'column4', '' ); ?>
+		</div>
 	</div>
-</div>
 
 	<?php
 	wp_nonce_field( 'closedpostboxes', 'closedpostboxesnonce', false );
@@ -334,7 +334,7 @@ function wp_dashboard_right_now() {
 		$text = sprintf( _n( '%s Comment', '%s Comments', $num_comm->approved ), number_format_i18n( $num_comm->approved ) );
 		?>
 		<li class="comment-count">
-			<a href="edit-comments.php"><?php echo $text; ?></a>
+			<a href="edit-comments.php"><?php echo esc_html( $text ); ?></a>
 		</li>
 		<?php
 		$moderated_comments_count_i18n = number_format_i18n( $num_comm->moderated );
@@ -342,7 +342,7 @@ function wp_dashboard_right_now() {
 		$text = sprintf( _n( '%s Comment in moderation', '%s Comments in moderation', $num_comm->moderated ), $moderated_comments_count_i18n );
 		?>
 		<li class="comment-mod-count<?php echo ! $num_comm->moderated ? ' hidden' : ''; ?>">
-			<a href="edit-comments.php?comment_status=moderated" class="comments-in-moderation-text"><?php echo $text; ?></a>
+			<a href="edit-comments.php?comment_status=moderated" class="comments-in-moderation-text"><?php echo esc_html( $text ); ?></a>
 		</li>
 		<?php
 	}
@@ -435,7 +435,7 @@ function wp_dashboard_right_now() {
 	if ( ! empty( $actions ) ) :
 		?>
 	<div class="sub">
-		<?php echo $actions; ?>
+		<?php echo esc_html( $actions ); ?>
 	</div>
 		<?php
 	endif;
@@ -601,7 +601,7 @@ function wp_dashboard_quick_press( $error_msg = false ) {
 
 		<p class="submit">
 			<input type="hidden" name="action" id="quickpost-action" value="post-quickdraft-save" />
-			<input type="hidden" name="post_ID" value="<?php echo $post_ID; ?>" />
+			<input type="hidden" name="post_ID" value="<?php echo esc_attr( $post_ID ); ?>" />
 			<input type="hidden" name="post_type" value="post" />
 			<?php wp_nonce_field( 'add-post' ); ?>
 			<?php submit_button( __( 'Save Draft' ), 'primary', 'save', false, array( 'id' => 'save-post' ) ); ?>
@@ -909,7 +909,7 @@ function _wp_dashboard_recent_comments_row( &$comment, $show_date = true ) {
 			<?php endif; // comment_type ?>
 			<blockquote><p><?php comment_excerpt( $comment ); ?></p></blockquote>
 			<?php if ( $actions_string ) : ?>
-			<p class="row-actions"><?php echo $actions_string; ?></p>
+			<p class="row-actions"><?php echo esc_html( $actions_string ); ?></p>
 			<?php endif; ?>
 			</div>
 		</li>
@@ -999,9 +999,9 @@ function wp_dashboard_recent_posts( $args ) {
 
 	if ( $posts->have_posts() ) {
 
-		echo '<div id="' . $args['id'] . '" class="activity-block">';
+		echo '<div id="' . esc_html( $args['id'] ) . '" class="activity-block">';
 
-		echo '<h3>' . $args['title'] . '</h3>';
+		echo '<h3>' . esc_html( $args['title'] ) . '</h3>';
 
 		echo '<ul>';