diff --git a/wp-admin/includes/media.php b/wp-admin/includes/media.php
index 5c54b21402..61c8b95760 100644
--- a/wp-admin/includes/media.php
+++ b/wp-admin/includes/media.php
@@ -3057,7 +3057,7 @@ function edit_form_image_editor( $post ) {
 		}
 		?>
 	</label>
-	<?php wp_editor( $post->post_content, 'attachment_content', $editor_args ); ?>
+	<?php wp_editor( format_to_edit( $post->post_content ), 'attachment_content', $editor_args ); ?>
 
 	</div>
 	<?php
diff --git a/wp-admin/includes/misc.php b/wp-admin/includes/misc.php
index 0dcebdfedb..08a89f2e4f 100644
--- a/wp-admin/includes/misc.php
+++ b/wp-admin/includes/misc.php
@@ -639,23 +639,46 @@ function set_screen_options() {
 				}
 				break;
 			default:
+				if ( '_page' === substr( $option, -5 ) || 'layout_columns' === $option ) {
+					/**
+					 * Filters a screen option value before it is set.
+					 *
+					 * The filter can also be used to modify non-standard [items]_per_page
+					 * settings. See the parent function for a full list of standard options.
+					 *
+					 * Returning false to the filter will skip saving the current option.
+					 *
+					 * @since 2.8.0
+					 * @since 5.4.2 Only applied to options ending with '_page',
+					 *              or the 'layout_columns' option.
+					 *
+					 * @see set_screen_options()
+					 *
+					 * @param bool   $keep   Whether to save or skip saving the screen option value.
+					 *                       Default false.
+					 * @param string $option The option name.
+					 * @param int    $value  The number of rows to use.
+					 */
+					$value = apply_filters( 'set-screen-option', false, $option, $value ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.UseUnderscores
+				}
+
 				/**
 				 * Filters a screen option value before it is set.
 				 *
-				 * The filter can also be used to modify non-standard [items]_per_page
-				 * settings. See the parent function for a full list of standard options.
+				 * The dynamic portion of the hook, `$option`, refers to the option name.
 				 *
 				 * Returning false to the filter will skip saving the current option.
 				 *
-				 * @since 2.8.0
+				 * @since 5.4.2
 				 *
 				 * @see set_screen_options()
 				 *
-				 * @param bool     $keep   Whether to save or skip saving the screen option value. Default false.
-				 * @param string   $option The option name.
-				 * @param int      $value  The number of rows to use.
+				 * @param bool   $keep   Whether to save or skip saving the screen option value.
+				 *                       Default false.
+				 * @param string $option The option name.
+				 * @param int    $value  The number of rows to use.
 				 */
-				$value = apply_filters( 'set-screen-option', false, $option, $value );
+				$value = apply_filters( "set_screen_option_{$option}", false, $option, $value );
 
 				if ( false === $value ) {
 					return;
diff --git a/wp-admin/themes.php b/wp-admin/themes.php
index 9561cfe602..1a296bad46 100644
--- a/wp-admin/themes.php
+++ b/wp-admin/themes.php
@@ -396,7 +396,7 @@ if ( ! is_multisite() && current_user_can( 'edit_themes' ) && $broken_themes = w
 	</tr>
 	<?php foreach ( $broken_themes as $broken_theme ) : ?>
 		<tr>
-			<td><?php echo $broken_theme->get( 'Name' ) ? $broken_theme->display( 'Name' ) : $broken_theme->get_stylesheet(); ?></td>
+			<td><?php echo $broken_theme->get( 'Name' ) ? $broken_theme->display( 'Name' ) : esc_html( $broken_theme->get_stylesheet() ); ?></td>
 			<td><?php echo $broken_theme->errors()->get_error_message(); ?></td>
 			<?php
 			if ( $can_resume ) {
diff --git a/wp-includes/blocks/rss.php b/wp-includes/blocks/rss.php
index b5fe3abaf5..316919bad2 100644
--- a/wp-includes/blocks/rss.php
+++ b/wp-includes/blocks/rss.php
@@ -80,7 +80,7 @@ function render_block_core_rss( $attributes ) {
 	}
 
 	$classes           = 'grid' === $attributes['blockLayout'] ? ' is-grid columns-' . $attributes['columns'] : '';
-	$list_items_markup = "<ul class='wp-block-rss{$classes}'>{$list_items}</ul>";
+	$list_items_markup = sprintf( "<ul class='%s'>%s</ul>", esc_attr( $class ), $list_items );
 
 	// PHP 5.2 compatibility. See: http://simplepie.org/wiki/faq/i_m_getting_memory_leaks.
 	$rss->__destruct();
diff --git a/wp-includes/blocks/search.php b/wp-includes/blocks/search.php
index ac7da463e9..f9bbe3eba5 100644
--- a/wp-includes/blocks/search.php
+++ b/wp-includes/blocks/search.php
@@ -46,7 +46,7 @@ function render_block_core_search( $attributes ) {
 
 	return sprintf(
 		'<form class="%s" role="search" method="get" action="%s">%s</form>',
-		$class,
+		esc_attr( $class ),
 		esc_url( home_url( '/' ) ),
 		$label_markup . $input_markup . $button_markup
 	);
diff --git a/wp-includes/default-filters.php b/wp-includes/default-filters.php
index 9e8c6bb708..fb75b3a475 100644
--- a/wp-includes/default-filters.php
+++ b/wp-includes/default-filters.php
@@ -573,8 +573,8 @@ add_filter( 'the_excerpt_embed', 'wpautop' );
 add_filter( 'the_excerpt_embed', 'shortcode_unautop' );
 add_filter( 'the_excerpt_embed', 'wp_embed_excerpt_attachment' );
 
+add_filter( 'oembed_dataparse', 'wp_filter_oembed_iframe_title_attribute', 5, 3 );
 add_filter( 'oembed_dataparse', 'wp_filter_oembed_result', 10, 3 );
-add_filter( 'oembed_dataparse', 'wp_filter_oembed_iframe_title_attribute', 20, 3 );
 add_filter( 'oembed_response_data', 'get_oembed_response_data_rich', 10, 4 );
 add_filter( 'pre_oembed_result', 'wp_filter_pre_oembed_result', 10, 3 );
 
diff --git a/wp-includes/embed.php b/wp-includes/embed.php
index 48c2212783..5fae5e7a41 100644
--- a/wp-includes/embed.php
+++ b/wp-includes/embed.php
@@ -797,11 +797,24 @@ function wp_filter_oembed_iframe_title_attribute( $result, $data, $url ) {
 
 	$title = ! empty( $data->title ) ? $data->title : '';
 
-	$pattern        = '`<iframe[^>]*?title=(\\\\\'|\\\\"|[\'"])([^>]*?)\1`i';
-	$has_title_attr = preg_match( $pattern, $result, $matches );
+	$pattern = '`<iframe([^>]*)>`i';
+	if ( preg_match( $pattern, $result, $matches ) ) {
+		$attrs = wp_kses_hair( $matches[1], wp_allowed_protocols() );
 
-	if ( $has_title_attr && ! empty( $matches[2] ) ) {
-		$title = $matches[2];
+		foreach ( $attrs as $attr => $item ) {
+			$lower_attr = strtolower( $attr );
+			if ( $lower_attr === $attr ) {
+				continue;
+			}
+			if ( ! isset( $attrs[ $lower_attr ] ) ) {
+				$attrs[ $lower_attr ] = $item;
+				unset( $attrs[ $attr ] );
+			}
+		}
+	}
+
+	if ( ! empty( $attrs['title']['value'] ) ) {
+		$title = $attrs['title']['value'];
 	}
 
 	/**
@@ -820,11 +833,11 @@ function wp_filter_oembed_iframe_title_attribute( $result, $data, $url ) {
 		return $result;
 	}
 
-	if ( $has_title_attr ) {
-		// Remove the old title, $matches[1]: quote, $matches[2]: title attribute value.
-		$result = str_replace( ' title=' . $matches[1] . $matches[2] . $matches[1], '', $result );
+	if ( isset( $attrs['title'] ) ) {
+		unset( $attrs['title'] );
+		$attr_string = join( ' ', wp_list_pluck( $attrs, 'whole' ) );
+		$result      = str_replace( $matches[0], '<iframe ' . trim( $attr_string ) . '>', $result );
 	}
-
 	return str_ireplace( '<iframe ', sprintf( '<iframe title="%s" ', esc_attr( $title ) ), $result );
 }
 
diff --git a/wp-includes/js/dist/i18n.js b/wp-includes/js/dist/i18n.js
index 71980617d6..6229841333 100644
--- a/wp-includes/js/dist/i18n.js
+++ b/wp-includes/js/dist/i18n.js
@@ -90,157 +90,182 @@ this["wp"] = this["wp"] || {}; this["wp"]["i18n"] =
 /***/ 137:
 /***/ (function(module, exports, __webpack_require__) {
 
-(function(window) {
+var __WEBPACK_AMD_DEFINE_RESULT__;/* global window, exports, define */
+
+!function() {
+    'use strict'
+
     var re = {
         not_string: /[^s]/,
+        not_bool: /[^t]/,
+        not_type: /[^T]/,
+        not_primitive: /[^v]/,
         number: /[diefg]/,
+        numeric_arg: /[bcdiefguxX]/,
         json: /[j]/,
         not_json: /[^j]/,
         text: /^[^\x25]+/,
         modulo: /^\x25{2}/,
-        placeholder: /^\x25(?:([1-9]\d*)\$|\(([^\)]+)\))?(\+)?(0|'[^$])?(-)?(\d+)?(?:\.(\d+))?([b-gijosuxX])/,
+        placeholder: /^\x25(?:([1-9]\d*)\$|\(([^)]+)\))?(\+)?(0|'[^$])?(-)?(\d+)?(?:\.(\d+))?([b-gijostTuvxX])/,
         key: /^([a-z_][a-z_\d]*)/i,
         key_access: /^\.([a-z_][a-z_\d]*)/i,
         index_access: /^\[(\d+)\]/,
-        sign: /^[\+\-]/
+        sign: /^[+-]/
     }
 
-    function sprintf() {
-        var key = arguments[0], cache = sprintf.cache
-        if (!(cache[key] && cache.hasOwnProperty(key))) {
-            cache[key] = sprintf.parse(key)
-        }
-        return sprintf.format.call(null, cache[key], arguments)
+    function sprintf(key) {
+        // `arguments` is not an array, but should be fine for this call
+        return sprintf_format(sprintf_parse(key), arguments)
     }
 
-    sprintf.format = function(parse_tree, argv) {
-        var cursor = 1, tree_length = parse_tree.length, node_type = "", arg, output = [], i, k, match, pad, pad_character, pad_length, is_positive = true, sign = ""
+    function vsprintf(fmt, argv) {
+        return sprintf.apply(null, [fmt].concat(argv || []))
+    }
+
+    function sprintf_format(parse_tree, argv) {
+        var cursor = 1, tree_length = parse_tree.length, arg, output = '', i, k, ph, pad, pad_character, pad_length, is_positive, sign
         for (i = 0; i < tree_length; i++) {
-            node_type = get_type(parse_tree[i])
-            if (node_type === "string") {
-                output[output.length] = parse_tree[i]
+            if (typeof parse_tree[i] === 'string') {
+                output += parse_tree[i]
             }
-            else if (node_type === "array") {
-                match = parse_tree[i] // convenience purposes only
-                if (match[2]) { // keyword argument
+            else if (typeof parse_tree[i] === 'object') {
+                ph = parse_tree[i] // convenience purposes only
+                if (ph.keys) { // keyword argument
                     arg = argv[cursor]
-                    for (k = 0; k < match[2].length; k++) {
-                        if (!arg.hasOwnProperty(match[2][k])) {
-                            throw new Error(sprintf("[sprintf] property '%s' does not exist", match[2][k]))
+                    for (k = 0; k < ph.keys.length; k++) {
+                        if (arg == undefined) {
+                            throw new Error(sprintf('[sprintf] Cannot access property "%s" of undefined value "%s"', ph.keys[k], ph.keys[k-1]))
                         }
-                        arg = arg[match[2][k]]
+                        arg = arg[ph.keys[k]]
                     }
                 }
-                else if (match[1]) { // positional argument (explicit)
-                    arg = argv[match[1]]
+                else if (ph.param_no) { // positional argument (explicit)
+                    arg = argv[ph.param_no]
                 }
                 else { // positional argument (implicit)
                     arg = argv[cursor++]
                 }
 
-                if (get_type(arg) == "function") {
+                if (re.not_type.test(ph.type) && re.not_primitive.test(ph.type) && arg instanceof Function) {
                     arg = arg()
                 }
 
-                if (re.not_string.test(match[8]) && re.not_json.test(match[8]) && (get_type(arg) != "number" && isNaN(arg))) {
-                    throw new TypeError(sprintf("[sprintf] expecting number but found %s", get_type(arg)))
+                if (re.numeric_arg.test(ph.type) && (typeof arg !== 'number' && isNaN(arg))) {
+                    throw new TypeError(sprintf('[sprintf] expecting number but found %T', arg))
                 }
 
-                if (re.number.test(match[8])) {
+                if (re.number.test(ph.type)) {
                     is_positive = arg >= 0
                 }
 
-                switch (match[8]) {
-                    case "b":
-                        arg = arg.toString(2)
-                    break
-                    case "c":
-                        arg = String.fromCharCode(arg)
-                    break
-                    case "d":
-                    case "i":
+                switch (ph.type) {
+                    case 'b':
+                        arg = parseInt(arg, 10).toString(2)
+                        break
+                    case 'c':
+                        arg = String.fromCharCode(parseInt(arg, 10))
+                        break
+                    case 'd':
+                    case 'i':
                         arg = parseInt(arg, 10)
-                    break
-                    case "j":
-                        arg = JSON.stringify(arg, null, match[6] ? parseInt(match[6]) : 0)
-                    break
-                    case "e":
-                        arg = match[7] ? arg.toExponential(match[7]) : arg.toExponential()
-                    break
-                    case "f":
-                        arg = match[7] ? parseFloat(arg).toFixed(match[7]) : parseFloat(arg)
-                    break
-                    case "g":
-                        arg = match[7] ? parseFloat(arg).toPrecision(match[7]) : parseFloat(arg)
-                    break
-                    case "o":
-                        arg = arg.toString(8)
-                    break
-                    case "s":
-                        arg = ((arg = String(arg)) && match[7] ? arg.substring(0, match[7]) : arg)
-                    break
-                    case "u":
-                        arg = arg >>> 0
-                    break
-                    case "x":
-                        arg = arg.toString(16)
-                    break
-                    case "X":
-                        arg = arg.toString(16).toUpperCase()
-                    break
+                        break
+                    case 'j':
+                        arg = JSON.stringify(arg, null, ph.width ? parseInt(ph.width) : 0)
+                        break
+                    case 'e':
+                        arg = ph.precision ? parseFloat(arg).toExponential(ph.precision) : parseFloat(arg).toExponential()
+                        break
+                    case 'f':
+                        arg = ph.precision ? parseFloat(arg).toFixed(ph.precision) : parseFloat(arg)
+                        break
+                    case 'g':
+                        arg = ph.precision ? String(Number(arg.toPrecision(ph.precision))) : parseFloat(arg)
+                        break
+                    case 'o':
+                        arg = (parseInt(arg, 10) >>> 0).toString(8)
+                        break
+                    case 's':
+                        arg = String(arg)
+                        arg = (ph.precision ? arg.substring(0, ph.precision) : arg)
+                        break
+                    case 't':
+                        arg = String(!!arg)
+                        arg = (ph.precision ? arg.substring(0, ph.precision) : arg)
+                        break
+                    case 'T':
+                        arg = Object.prototype.toString.call(arg).slice(8, -1).toLowerCase()
+                        arg = (ph.precision ? arg.substring(0, ph.precision) : arg)
+                        break
+                    case 'u':
+                        arg = parseInt(arg, 10) >>> 0
+                        break
+                    case 'v':
+                        arg = arg.valueOf()
+                        arg = (ph.precision ? arg.substring(0, ph.precision) : arg)
+                        break
+                    case 'x':
+                        arg = (parseInt(arg, 10) >>> 0).toString(16)
+                        break
+                    case 'X':
+                        arg = (parseInt(arg, 10) >>> 0).toString(16).toUpperCase()
+                        break
                 }
-                if (re.json.test(match[8])) {
-                    output[output.length] = arg
+                if (re.json.test(ph.type)) {
+                    output += arg
                 }
                 else {
-                    if (re.number.test(match[8]) && (!is_positive || match[3])) {
-                        sign = is_positive ? "+" : "-"
-                        arg = arg.toString().replace(re.sign, "")
+                    if (re.number.test(ph.type) && (!is_positive || ph.sign)) {
+                        sign = is_positive ? '+' : '-'
+                        arg = arg.toString().replace(re.sign, '')
                     }
                     else {
-                        sign = ""
+                        sign = ''
                     }
-                    pad_character = match[4] ? match[4] === "0" ? "0" : match[4].charAt(1) : " "
-                    pad_length = match[6] - (sign + arg).length
-                    pad = match[6] ? (pad_length > 0 ? str_repeat(pad_character, pad_length) : "") : ""
-                    output[output.length] = match[5] ? sign + arg + pad : (pad_character === "0" ? sign + pad + arg : pad + sign + arg)
+                    pad_character = ph.pad_char ? ph.pad_char === '0' ? '0' : ph.pad_char.charAt(1) : ' '
+                    pad_length = ph.width - (sign + arg).length
+                    pad = ph.width ? (pad_length > 0 ? pad_character.repeat(pad_length) : '') : ''
+                    output += ph.align ? sign + arg + pad : (pad_character === '0' ? sign + pad + arg : pad + sign + arg)
                 }
             }
         }
-        return output.join("")
+        return output
     }
 
-    sprintf.cache = {}
+    var sprintf_cache = Object.create(null)
 
-    sprintf.parse = function(fmt) {
-        var _fmt = fmt, match = [], parse_tree = [], arg_names = 0
+    function sprintf_parse(fmt) {
+        if (sprintf_cache[fmt]) {
+            return sprintf_cache[fmt]
+        }
+
+        var _fmt = fmt, match, parse_tree = [], arg_names = 0
         while (_fmt) {
             if ((match = re.text.exec(_fmt)) !== null) {
-                parse_tree[parse_tree.length] = match[0]
+                parse_tree.push(match[0])
             }
             else if ((match = re.modulo.exec(_fmt)) !== null) {
-                parse_tree[parse_tree.length] = "%"
+                parse_tree.push('%')
             }
             else if ((match = re.placeholder.exec(_fmt)) !== null) {
                 if (match[2]) {
                     arg_names |= 1
                     var field_list = [], replacement_field = match[2], field_match = []
                     if ((field_match = re.key.exec(replacement_field)) !== null) {
-                        field_list[field_list.length] = field_match[1]
-                        while ((replacement_field = replacement_field.substring(field_match[0].length)) !== "") {
+                        field_list.push(field_match[1])
+                        while ((replacement_field = replacement_field.substring(field_match[0].length)) !== '') {
                             if ((field_match = re.key_access.exec(replacement_field)) !== null) {
-                                field_list[field_list.length] = field_match[1]
+                                field_list.push(field_match[1])
                             }
                             else if ((field_match = re.index_access.exec(replacement_field)) !== null) {
-                                field_list[field_list.length] = field_match[1]
+                                field_list.push(field_match[1])
                             }
                             else {
-                                throw new SyntaxError("[sprintf] failed to parse named argument key")
+                                throw new SyntaxError('[sprintf] failed to parse named argument key')
                             }
                         }
                     }
                     else {
-                        throw new SyntaxError("[sprintf] failed to parse named argument key")
+                        throw new SyntaxError('[sprintf] failed to parse named argument key')
                     }
                     match[2] = field_list
                 }
@@ -248,44 +273,55 @@ this["wp"] = this["wp"] || {}; this["wp"]["i18n"] =
                     arg_names |= 2
                 }
                 if (arg_names === 3) {
-                    throw new Error("[sprintf] mixing positional and named placeholders is not (yet) supported")
+                    throw new Error('[sprintf] mixing positional and named placeholders is not (yet) supported')
                 }
-                parse_tree[parse_tree.length] = match
+
+                parse_tree.push(
+                    {
+                        placeholder: match[0],
+                        param_no:    match[1],
+                        keys:        match[2],
+                        sign:        match[3],
+                        pad_char:    match[4],
+                        align:       match[5],
+                        width:       match[6],
+                        precision:   match[7],
+                        type:        match[8]
+                    }
+                )
             }
             else {
-                throw new SyntaxError("[sprintf] unexpected placeholder")
+                throw new SyntaxError('[sprintf] unexpected placeholder')
             }
             _fmt = _fmt.substring(match[0].length)
         }
-        return parse_tree
-    }
-
-    var vsprintf = function(fmt, argv, _argv) {
-        _argv = (argv || []).slice(0)
-        _argv.splice(0, 0, fmt)
-        return sprintf.apply(null, _argv)
-    }
-
-    /**
-     * helpers
-     */
-    function get_type(variable) {
-        return Object.prototype.toString.call(variable).slice(8, -1).toLowerCase()
-    }
-
-    function str_repeat(input, multiplier) {
-        return Array(multiplier + 1).join(input)
+        return sprintf_cache[fmt] = parse_tree
     }
 
     /**
      * export to either browser or node.js
      */
+    /* eslint-disable quote-props */
     if (true) {
-        exports.sprintf = sprintf
-        exports.vsprintf = vsprintf
+        exports['sprintf'] = sprintf
+        exports['vsprintf'] = vsprintf
     }
-    else {}
-})(typeof window === "undefined" ? this : window);
+    if (typeof window !== 'undefined') {
+        window['sprintf'] = sprintf
+        window['vsprintf'] = vsprintf
+
+        if (true) {
+            !(__WEBPACK_AMD_DEFINE_RESULT__ = (function() {
+                return {
+                    'sprintf': sprintf,
+                    'vsprintf': vsprintf
+                }
+            }).call(exports, __webpack_require__, exports, module),
+				__WEBPACK_AMD_DEFINE_RESULT__ !== undefined && (module.exports = __WEBPACK_AMD_DEFINE_RESULT__))
+        }
+    }
+    /* eslint-enable quote-props */
+}(); // eslint-disable-line
 
 
 /***/ }),
@@ -767,7 +803,7 @@ Tannin.prototype.dcnpgettext = function( domain, context, singular, plural, n )
 var memize = __webpack_require__(41);
 var memize_default = /*#__PURE__*/__webpack_require__.n(memize);
 
-// EXTERNAL MODULE: ./node_modules/sprintf-js/src/sprintf.js
+// EXTERNAL MODULE: ./node_modules/@wordpress/i18n/node_modules/sprintf-js/src/sprintf.js
 var sprintf = __webpack_require__(137);
 var sprintf_default = /*#__PURE__*/__webpack_require__.n(sprintf);
 
diff --git a/wp-includes/js/dist/i18n.min.js b/wp-includes/js/dist/i18n.min.js
index 587cf8ef19..2ba399dcd1 100644
--- a/wp-includes/js/dist/i18n.min.js
+++ b/wp-includes/js/dist/i18n.min.js
@@ -1 +1 @@
-this.wp=this.wp||{},this.wp.i18n=function(n){var t={};function r(e){if(t[e])return t[e].exports;var o=t[e]={i:e,l:!1,exports:{}};return n[e].call(o.exports,o,o.exports,r),o.l=!0,o.exports}return r.m=n,r.c=t,r.d=function(n,t,e){r.o(n,t)||Object.defineProperty(n,t,{enumerable:!0,get:e})},r.r=function(n){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(n,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(n,"__esModule",{value:!0})},r.t=function(n,t){if(1&t&&(n=r(n)),8&t)return n;if(4&t&&"object"==typeof n&&n&&n.__esModule)return n;var e=Object.create(null);if(r.r(e),Object.defineProperty(e,"default",{enumerable:!0,value:n}),2&t&&"string"!=typeof n)for(var o in n)r.d(e,o,function(t){return n[t]}.bind(null,o));return e},r.n=function(n){var t=n&&n.__esModule?function(){return n.default}:function(){return n};return r.d(t,"a",t),t},r.o=function(n,t){return Object.prototype.hasOwnProperty.call(n,t)},r.p="",r(r.s=376)}({137:function(n,t,r){!function(n){var r={not_string:/[^s]/,number:/[diefg]/,json:/[j]/,not_json:/[^j]/,text:/^[^\x25]+/,modulo:/^\x25{2}/,placeholder:/^\x25(?:([1-9]\d*)\$|\(([^\)]+)\))?(\+)?(0|'[^$])?(-)?(\d+)?(?:\.(\d+))?([b-gijosuxX])/,key:/^([a-z_][a-z_\d]*)/i,key_access:/^\.([a-z_][a-z_\d]*)/i,index_access:/^\[(\d+)\]/,sign:/^[\+\-]/};function e(){var n=arguments[0],t=e.cache;return t[n]&&t.hasOwnProperty(n)||(t[n]=e.parse(n)),e.format.call(null,t[n],arguments)}e.format=function(n,t){var i,u,a,l,s,c,f,p,d=1,g=n.length,h="",v=[],b=!0,y="";for(u=0;u<g;u++)if("string"===(h=o(n[u])))v[v.length]=n[u];else if("array"===h){if((l=n[u])[2])for(i=t[d],a=0;a<l[2].length;a++){if(!i.hasOwnProperty(l[2][a]))throw new Error(e("[sprintf] property '%s' does not exist",l[2][a]));i=i[l[2][a]]}else i=l[1]?t[l[1]]:t[d++];if("function"==o(i)&&(i=i()),r.not_string.test(l[8])&&r.not_json.test(l[8])&&"number"!=o(i)&&isNaN(i))throw new TypeError(e("[sprintf] expecting number but found %s",o(i)));switch(r.number.test(l[8])&&(b=i>=0),l[8]){case"b":i=i.toString(2);break;case"c":i=String.fromCharCode(i);break;case"d":case"i":i=parseInt(i,10);break;case"j":i=JSON.stringify(i,null,l[6]?parseInt(l[6]):0);break;case"e":i=l[7]?i.toExponential(l[7]):i.toExponential();break;case"f":i=l[7]?parseFloat(i).toFixed(l[7]):parseFloat(i);break;case"g":i=l[7]?parseFloat(i).toPrecision(l[7]):parseFloat(i);break;case"o":i=i.toString(8);break;case"s":i=(i=String(i))&&l[7]?i.substring(0,l[7]):i;break;case"u":i>>>=0;break;case"x":i=i.toString(16);break;case"X":i=i.toString(16).toUpperCase()}r.json.test(l[8])?v[v.length]=i:(!r.number.test(l[8])||b&&!l[3]?y="":(y=b?"+":"-",i=i.toString().replace(r.sign,"")),c=l[4]?"0"===l[4]?"0":l[4].charAt(1):" ",f=l[6]-(y+i).length,s=l[6]&&f>0?(p=c,Array(f+1).join(p)):"",v[v.length]=l[5]?y+i+s:"0"===c?y+s+i:s+y+i)}return v.join("")},e.cache={},e.parse=function(n){for(var t=n,e=[],o=[],i=0;t;){if(null!==(e=r.text.exec(t)))o[o.length]=e[0];else if(null!==(e=r.modulo.exec(t)))o[o.length]="%";else{if(null===(e=r.placeholder.exec(t)))throw new SyntaxError("[sprintf] unexpected placeholder");if(e[2]){i|=1;var u=[],a=e[2],l=[];if(null===(l=r.key.exec(a)))throw new SyntaxError("[sprintf] failed to parse named argument key");for(u[u.length]=l[1];""!==(a=a.substring(l[0].length));)if(null!==(l=r.key_access.exec(a)))u[u.length]=l[1];else{if(null===(l=r.index_access.exec(a)))throw new SyntaxError("[sprintf] failed to parse named argument key");u[u.length]=l[1]}e[2]=u}else i|=2;if(3===i)throw new Error("[sprintf] mixing positional and named placeholders is not (yet) supported");o[o.length]=e}t=t.substring(e[0].length)}return o};function o(n){return Object.prototype.toString.call(n).slice(8,-1).toLowerCase()}t.sprintf=e,t.vsprintf=function(n,t,r){return(r=(t||[]).slice(0)).splice(0,0,n),e.apply(null,r)}}("undefined"==typeof window||window)},15:function(n,t,r){"use strict";function e(n,t,r){return t in n?Object.defineProperty(n,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):n[t]=r,n}r.d(t,"a",function(){return e})},376:function(n,t,r){"use strict";r.r(t);var e,o,i,u,a=r(7);e={"(":9,"!":8,"*":7,"/":7,"%":7,"+":6,"-":6,"<":5,"<=":5,">":5,">=":5,"==":4,"!=":4,"&&":3,"||":2,"?":1,"?:":1},o=["(","?"],i={")":["("],":":["?","?:"]},u=/<=|>=|==|!=|&&|\|\||\?:|\(|!|\*|\/|%|\+|-|<|>|\?|\)|:/;var l={"!":function(n){return!n},"*":function(n,t){return n*t},"/":function(n,t){return n/t},"%":function(n,t){return n%t},"+":function(n,t){return n+t},"-":function(n,t){return n-t},"<":function(n,t){return n<t},"<=":function(n,t){return n<=t},">":function(n,t){return n>t},">=":function(n,t){return n>=t},"==":function(n,t){return n===t},"!=":function(n,t){return n!==t},"&&":function(n,t){return n&&t},"||":function(n,t){return n||t},"?:":function(n,t,r){if(n)throw t;return r}};function s(n){var t=function(n){for(var t,r,a,l,s=[],c=[];t=n.match(u);){for(r=t[0],(a=n.substr(0,t.index).trim())&&s.push(a);l=c.pop();){if(i[r]){if(i[r][0]===l){r=i[r][1]||r;break}}else if(o.indexOf(l)>=0||e[l]<e[r]){c.push(l);break}s.push(l)}i[r]||c.push(r),n=n.substr(t.index+r.length)}return(n=n.trim())&&s.push(n),s.concat(c.reverse())}(n);return function(n){return function(n,t){var r,e,o,i,u,a,s=[];for(r=0;r<n.length;r++){if(u=n[r],i=l[u]){for(e=i.length,o=Array(e);e--;)o[e]=s.pop();try{a=i.apply(null,o)}catch(n){return n}}else a=t.hasOwnProperty(u)?t[u]:+u;s.push(a)}return s[0]}(t,n)}}var c={contextDelimiter:"",onMissingKey:null};function f(n,t){var r;for(r in this.data=n,this.pluralForms={},t=t||{},this.options={},c)this.options[r]=t[r]||c[r]}f.prototype.getPluralForm=function(n,t){var r,e,o,i,u=this.pluralForms[n];return u||("function"!=typeof(o=(r=this.data[n][""])["Plural-Forms"]||r["plural-forms"]||r.plural_forms)&&(e=function(n){var t,r,e;for(t=n.split(";"),r=0;r<t.length;r++)if(0===(e=t[r].trim()).indexOf("plural="))return e.substr(7)}(r["Plural-Forms"]||r["plural-forms"]||r.plural_forms),i=s(e),o=function(n){return+i({n:n})}),u=this.pluralForms[n]=o),u(t)},f.prototype.dcnpgettext=function(n,t,r,e,o){var i,u,a;return i=void 0===o?0:this.getPluralForm(n,o),u=r,t&&(u=t+this.options.contextDelimiter+r),(a=this.data[n][u])&&a[i]?a[i]:(this.options.onMissingKey&&this.options.onMissingKey(r,n),0===i?r:e)};var p=r(41),d=r.n(p),g=r(137),h=r.n(g);r.d(t,"setLocaleData",function(){return x}),r.d(t,"__",function(){return w}),r.d(t,"_x",function(){return j}),r.d(t,"_n",function(){return _}),r.d(t,"_nx",function(){return O}),r.d(t,"sprintf",function(){return S});var v={"":{plural_forms:"plural=(n!=1)"}},b=d()(console.error),y=new f({});function x(n){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:"default";y.data[t]=Object(a.a)({},v,y.data[t],n),y.data[t][""]=Object(a.a)({},v[""],y.data[t][""])}function m(){var n=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"default",t=arguments.length>1?arguments[1]:void 0,r=arguments.length>2?arguments[2]:void 0,e=arguments.length>3?arguments[3]:void 0,o=arguments.length>4?arguments[4]:void 0;return y.data[n]||x(void 0,n),y.dcnpgettext(n,t,r,e,o)}function w(n,t){return m(t,void 0,n)}function j(n,t,r){return m(r,t,n)}function _(n,t,r,e){return m(e,void 0,n,t,r)}function O(n,t,r,e,o){return m(o,e,n,t,r)}function S(n){try{for(var t=arguments.length,r=new Array(t>1?t-1:0),e=1;e<t;e++)r[e-1]=arguments[e];return h.a.sprintf.apply(h.a,[n].concat(r))}catch(t){return b("sprintf error: \n\n"+t.toString()),n}}},41:function(n,t,r){n.exports=function(n,t){var r,e,o,i=0;function u(){var t,u,a=e,l=arguments.length;n:for(;a;){if(a.args.length===arguments.length){for(u=0;u<l;u++)if(a.args[u]!==arguments[u]){a=a.next;continue n}return a!==e&&(a===o&&(o=a.prev),a.prev.next=a.next,a.next&&(a.next.prev=a.prev),a.next=e,a.prev=null,e.prev=a,e=a),a.val}a=a.next}for(t=new Array(l),u=0;u<l;u++)t[u]=arguments[u];return a={args:t,val:n.apply(null,t)},e?(e.prev=a,a.next=e):o=a,i===r?(o=o.prev).next=null:i++,e=a,a.val}return t&&t.maxSize&&(r=t.maxSize),u.clear=function(){e=null,o=null,i=0},u}},7:function(n,t,r){"use strict";r.d(t,"a",function(){return o});var e=r(15);function o(n){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{},o=Object.keys(r);"function"==typeof Object.getOwnPropertySymbols&&(o=o.concat(Object.getOwnPropertySymbols(r).filter(function(n){return Object.getOwnPropertyDescriptor(r,n).enumerable}))),o.forEach(function(t){Object(e.a)(n,t,r[t])})}return n}}});
\ No newline at end of file
+this.wp=this.wp||{},this.wp.i18n=function(n){var t={};function e(r){if(t[r])return t[r].exports;var i=t[r]={i:r,l:!1,exports:{}};return n[r].call(i.exports,i,i.exports,e),i.l=!0,i.exports}return e.m=n,e.c=t,e.d=function(n,t,r){e.o(n,t)||Object.defineProperty(n,t,{enumerable:!0,get:r})},e.r=function(n){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(n,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(n,"__esModule",{value:!0})},e.t=function(n,t){if(1&t&&(n=e(n)),8&t)return n;if(4&t&&"object"==typeof n&&n&&n.__esModule)return n;var r=Object.create(null);if(e.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:n}),2&t&&"string"!=typeof n)for(var i in n)e.d(r,i,function(t){return n[t]}.bind(null,i));return r},e.n=function(n){var t=n&&n.__esModule?function(){return n.default}:function(){return n};return e.d(t,"a",t),t},e.o=function(n,t){return Object.prototype.hasOwnProperty.call(n,t)},e.p="",e(e.s=376)}({137:function(n,t,e){var r;!function(){"use strict";var i={not_string:/[^s]/,not_bool:/[^t]/,not_type:/[^T]/,not_primitive:/[^v]/,number:/[diefg]/,numeric_arg:/[bcdiefguxX]/,json:/[j]/,not_json:/[^j]/,text:/^[^\x25]+/,modulo:/^\x25{2}/,placeholder:/^\x25(?:([1-9]\d*)\$|\(([^)]+)\))?(\+)?(0|'[^$])?(-)?(\d+)?(?:\.(\d+))?([b-gijostTuvxX])/,key:/^([a-z_][a-z_\d]*)/i,key_access:/^\.([a-z_][a-z_\d]*)/i,index_access:/^\[(\d+)\]/,sign:/^[+-]/};function o(n){return function(n,t){var e,r,u,a,s,c,l,p,f,d=1,h=n.length,g="";for(r=0;r<h;r++)if("string"==typeof n[r])g+=n[r];else if("object"==typeof n[r]){if((a=n[r]).keys)for(e=t[d],u=0;u<a.keys.length;u++){if(null==e)throw new Error(o('[sprintf] Cannot access property "%s" of undefined value "%s"',a.keys[u],a.keys[u-1]));e=e[a.keys[u]]}else e=a.param_no?t[a.param_no]:t[d++];if(i.not_type.test(a.type)&&i.not_primitive.test(a.type)&&e instanceof Function&&(e=e()),i.numeric_arg.test(a.type)&&"number"!=typeof e&&isNaN(e))throw new TypeError(o("[sprintf] expecting number but found %T",e));switch(i.number.test(a.type)&&(p=e>=0),a.type){case"b":e=parseInt(e,10).toString(2);break;case"c":e=String.fromCharCode(parseInt(e,10));break;case"d":case"i":e=parseInt(e,10);break;case"j":e=JSON.stringify(e,null,a.width?parseInt(a.width):0);break;case"e":e=a.precision?parseFloat(e).toExponential(a.precision):parseFloat(e).toExponential();break;case"f":e=a.precision?parseFloat(e).toFixed(a.precision):parseFloat(e);break;case"g":e=a.precision?String(Number(e.toPrecision(a.precision))):parseFloat(e);break;case"o":e=(parseInt(e,10)>>>0).toString(8);break;case"s":e=String(e),e=a.precision?e.substring(0,a.precision):e;break;case"t":e=String(!!e),e=a.precision?e.substring(0,a.precision):e;break;case"T":e=Object.prototype.toString.call(e).slice(8,-1).toLowerCase(),e=a.precision?e.substring(0,a.precision):e;break;case"u":e=parseInt(e,10)>>>0;break;case"v":e=e.valueOf(),e=a.precision?e.substring(0,a.precision):e;break;case"x":e=(parseInt(e,10)>>>0).toString(16);break;case"X":e=(parseInt(e,10)>>>0).toString(16).toUpperCase()}i.json.test(a.type)?g+=e:(!i.number.test(a.type)||p&&!a.sign?f="":(f=p?"+":"-",e=e.toString().replace(i.sign,"")),c=a.pad_char?"0"===a.pad_char?"0":a.pad_char.charAt(1):" ",l=a.width-(f+e).length,s=a.width&&l>0?c.repeat(l):"",g+=a.align?f+e+s:"0"===c?f+s+e:s+f+e)}return g}(function(n){if(a[n])return a[n];var t,e=n,r=[],o=0;for(;e;){if(null!==(t=i.text.exec(e)))r.push(t[0]);else if(null!==(t=i.modulo.exec(e)))r.push("%");else{if(null===(t=i.placeholder.exec(e)))throw new SyntaxError("[sprintf] unexpected placeholder");if(t[2]){o|=1;var u=[],s=t[2],c=[];if(null===(c=i.key.exec(s)))throw new SyntaxError("[sprintf] failed to parse named argument key");for(u.push(c[1]);""!==(s=s.substring(c[0].length));)if(null!==(c=i.key_access.exec(s)))u.push(c[1]);else{if(null===(c=i.index_access.exec(s)))throw new SyntaxError("[sprintf] failed to parse named argument key");u.push(c[1])}t[2]=u}else o|=2;if(3===o)throw new Error("[sprintf] mixing positional and named placeholders is not (yet) supported");r.push({placeholder:t[0],param_no:t[1],keys:t[2],sign:t[3],pad_char:t[4],align:t[5],width:t[6],precision:t[7],type:t[8]})}e=e.substring(t[0].length)}return a[n]=r}(n),arguments)}function u(n,t){return o.apply(null,[n].concat(t||[]))}var a=Object.create(null);t.sprintf=o,t.vsprintf=u,"undefined"!=typeof window&&(window.sprintf=o,window.vsprintf=u,void 0===(r=function(){return{sprintf:o,vsprintf:u}}.call(t,e,t,n))||(n.exports=r))}()},15:function(n,t,e){"use strict";function r(n,t,e){return t in n?Object.defineProperty(n,t,{value:e,enumerable:!0,configurable:!0,writable:!0}):n[t]=e,n}e.d(t,"a",function(){return r})},376:function(n,t,e){"use strict";e.r(t);var r,i,o,u,a=e(7);r={"(":9,"!":8,"*":7,"/":7,"%":7,"+":6,"-":6,"<":5,"<=":5,">":5,">=":5,"==":4,"!=":4,"&&":3,"||":2,"?":1,"?:":1},i=["(","?"],o={")":["("],":":["?","?:"]},u=/<=|>=|==|!=|&&|\|\||\?:|\(|!|\*|\/|%|\+|-|<|>|\?|\)|:/;var s={"!":function(n){return!n},"*":function(n,t){return n*t},"/":function(n,t){return n/t},"%":function(n,t){return n%t},"+":function(n,t){return n+t},"-":function(n,t){return n-t},"<":function(n,t){return n<t},"<=":function(n,t){return n<=t},">":function(n,t){return n>t},">=":function(n,t){return n>=t},"==":function(n,t){return n===t},"!=":function(n,t){return n!==t},"&&":function(n,t){return n&&t},"||":function(n,t){return n||t},"?:":function(n,t,e){if(n)throw t;return e}};function c(n){var t=function(n){for(var t,e,a,s,c=[],l=[];t=n.match(u);){for(e=t[0],(a=n.substr(0,t.index).trim())&&c.push(a);s=l.pop();){if(o[e]){if(o[e][0]===s){e=o[e][1]||e;break}}else if(i.indexOf(s)>=0||r[s]<r[e]){l.push(s);break}c.push(s)}o[e]||l.push(e),n=n.substr(t.index+e.length)}return(n=n.trim())&&c.push(n),c.concat(l.reverse())}(n);return function(n){return function(n,t){var e,r,i,o,u,a,c=[];for(e=0;e<n.length;e++){if(u=n[e],o=s[u]){for(r=o.length,i=Array(r);r--;)i[r]=c.pop();try{a=o.apply(null,i)}catch(n){return n}}else a=t.hasOwnProperty(u)?t[u]:+u;c.push(a)}return c[0]}(t,n)}}var l={contextDelimiter:"",onMissingKey:null};function p(n,t){var e;for(e in this.data=n,this.pluralForms={},t=t||{},this.options={},l)this.options[e]=t[e]||l[e]}p.prototype.getPluralForm=function(n,t){var e,r,i,o,u=this.pluralForms[n];return u||("function"!=typeof(i=(e=this.data[n][""])["Plural-Forms"]||e["plural-forms"]||e.plural_forms)&&(r=function(n){var t,e,r;for(t=n.split(";"),e=0;e<t.length;e++)if(0===(r=t[e].trim()).indexOf("plural="))return r.substr(7)}(e["Plural-Forms"]||e["plural-forms"]||e.plural_forms),o=c(r),i=function(n){return+o({n:n})}),u=this.pluralForms[n]=i),u(t)},p.prototype.dcnpgettext=function(n,t,e,r,i){var o,u,a;return o=void 0===i?0:this.getPluralForm(n,i),u=e,t&&(u=t+this.options.contextDelimiter+e),(a=this.data[n][u])&&a[o]?a[o]:(this.options.onMissingKey&&this.options.onMissingKey(e,n),0===o?e:r)};var f=e(41),d=e.n(f),h=e(137),g=e.n(h);e.d(t,"setLocaleData",function(){return x}),e.d(t,"__",function(){return w}),e.d(t,"_x",function(){return _}),e.d(t,"_n",function(){return k}),e.d(t,"_nx",function(){return j}),e.d(t,"sprintf",function(){return O});var y={"":{plural_forms:"plural=(n!=1)"}},v=d()(console.error),b=new p({});function x(n){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:"default";b.data[t]=Object(a.a)({},y,b.data[t],n),b.data[t][""]=Object(a.a)({},y[""],b.data[t][""])}function m(){var n=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"default",t=arguments.length>1?arguments[1]:void 0,e=arguments.length>2?arguments[2]:void 0,r=arguments.length>3?arguments[3]:void 0,i=arguments.length>4?arguments[4]:void 0;return b.data[n]||x(void 0,n),b.dcnpgettext(n,t,e,r,i)}function w(n,t){return m(t,void 0,n)}function _(n,t,e){return m(e,t,n)}function k(n,t,e,r){return m(r,void 0,n,t,e)}function j(n,t,e,r,i){return m(i,r,n,t,e)}function O(n){try{for(var t=arguments.length,e=new Array(t>1?t-1:0),r=1;r<t;r++)e[r-1]=arguments[r];return g.a.sprintf.apply(g.a,[n].concat(e))}catch(t){return v("sprintf error: \n\n"+t.toString()),n}}},41:function(n,t,e){n.exports=function(n,t){var e,r,i,o=0;function u(){var t,u,a=r,s=arguments.length;n:for(;a;){if(a.args.length===arguments.length){for(u=0;u<s;u++)if(a.args[u]!==arguments[u]){a=a.next;continue n}return a!==r&&(a===i&&(i=a.prev),a.prev.next=a.next,a.next&&(a.next.prev=a.prev),a.next=r,a.prev=null,r.prev=a,r=a),a.val}a=a.next}for(t=new Array(s),u=0;u<s;u++)t[u]=arguments[u];return a={args:t,val:n.apply(null,t)},r?(r.prev=a,a.next=r):i=a,o===e?(i=i.prev).next=null:o++,r=a,a.val}return t&&t.maxSize&&(e=t.maxSize),u.clear=function(){r=null,i=null,o=0},u}},7:function(n,t,e){"use strict";e.d(t,"a",function(){return i});var r=e(15);function i(n){for(var t=1;t<arguments.length;t++){var e=null!=arguments[t]?arguments[t]:{},i=Object.keys(e);"function"==typeof Object.getOwnPropertySymbols&&(i=i.concat(Object.getOwnPropertySymbols(e).filter(function(n){return Object.getOwnPropertyDescriptor(e,n).enumerable}))),i.forEach(function(t){Object(r.a)(n,t,e[t])})}return n}}});
\ No newline at end of file
diff --git a/wp-includes/pluggable.php b/wp-includes/pluggable.php
index 8ae4894550..c0dc11940e 100644
--- a/wp-includes/pluggable.php
+++ b/wp-includes/pluggable.php
@@ -1374,9 +1374,9 @@ if ( ! function_exists( 'wp_validate_redirect' ) ) :
 	 * @return string redirect-sanitized URL
 	 */
 	function wp_validate_redirect( $location, $default = '' ) {
-		$location = trim( $location, " \t\n\r\0\x08\x0B" );
-		// browsers will assume 'http' is your protocol, and will obey a redirect to a URL starting with '//'
-		if ( substr( $location, 0, 2 ) == '//' ) {
+		$location = wp_sanitize_redirect( trim( $location, " \t\n\r\0\x08\x0B" ) );
+		// Browsers will assume 'http' is your protocol, and will obey a redirect to a URL starting with '//'.
+		if ( '//' === substr( $location, 0, 2 ) ) {
 			$location = 'http:' . $location;
 		}