$user_login double escaped with incorrect/empty password in wp-login.php

[johnjamesjacoby]

First:

		if ( isset( $_POST['log'] ) ) {
			$user_login = ( 'incorrect_password' === $errors->get_error_code() || 'empty_password' === $errors->get_error_code() ) ? esc_attr( wp_unslash( $_POST['log'] ) ) : '';
		}

Then:

<input type="text" name="log" id="user_login"<?php echo $aria_describedby_error; ?> class="input" value="<?php echo esc_attr( $user_login ); ?>" size="20" autocapitalize="off" />

Fix is to late escape only, and remove the top one.

[johnjamesjacoby]

Relatedly, 'register' action is double wp_unslash()ing $user_email and $user_login.