diff --git a/wp-includes/functions.php b/wp-includes/functions.php
index 56c36067bc..c303f0d4a6 100644
--- a/wp-includes/functions.php
+++ b/wp-includes/functions.php
@@ -3584,10 +3584,12 @@ function wp_nonce_ays( $action ) {
 	} else {
 		$html = __( 'The link you followed has expired.' );
 		if ( wp_get_referer() ) {
+			$wp_http_referer = remove_query_arg( 'updated', wp_get_referer() );
+			$wp_http_referer = wp_validate_redirect( esc_url_raw( $wp_http_referer ) );
 			$html .= '</p><p>';
 			$html .= sprintf(
 				'<a href="%s">%s</a>',
-				esc_url( remove_query_arg( 'updated', wp_get_referer() ) ),
+				esc_url( $wp_http_referer ),
 				__( 'Please try again.' )
 			);
 		}
diff --git a/wp-includes/version.php b/wp-includes/version.php
index ad0e1dc535..e7b8ca5f6f 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '6.1-RC1-54521';
+$wp_version = '6.1-RC1-54522';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.