Missing escaping function for H1 in wp-login.php

[khokansardar]

In wp-login.php file, there is missing escaping function for login header text -

<h1><a href="<?php echo esc_url( $login_header_url ); ?>"><?php echo $login_header_text; ?></a></h1>

This $login_header_text has below filter to modify the text, which may cause unexpected security issue.

<?php
/**
         * Filters the link text of the header logo above the login form.
         *
         * @since 5.2.0
         *
         * @param string $login_header_text The login header logo link text.
         */
        $login_header_text = apply_filters( 'login_headertext', $login_header_text );

[swissspidy]

Duplicate of #58305.

This is by design.

Escaping function added for h1 login text in wp-login.php file

Trac ticket: https://core.trac.wordpress.org/ticket/59257

[khokansardar]

Patch added. Thanks.