Many strings or URLs lack proper escaping.

[yagniksangani]

Upon reviewing various strings and URLs within the WordPress core codebase, it has been noted that many instances lack proper escaping.

This absence of escaping poses a security risk, as it can potentially lead to vulnerabilities such as cross-site scripting (XSS) attacks. Unescaped output allows malicious users to inject scripts into web pages viewed by other users.

For example, you can see it here, \wp-activate.php

[yagniksangani]

Added escaping for some Strings and URLs

[audrasjb]

Hello and thanks for the ticket and patch,

However, esc_html_e is a internationalization function and should not be used here as this function is only meant for translatable text.

[sabernhardt]

#58305 already suggested escaping $login_header_text, but the decision there was to leave that variable unescaped.