diff --git a/wp-admin/includes/class-wp-ms-themes-list-table.php b/wp-admin/includes/class-wp-ms-themes-list-table.php
index dc5f37e385..c73bc97a44 100644
--- a/wp-admin/includes/class-wp-ms-themes-list-table.php
+++ b/wp-admin/includes/class-wp-ms-themes-list-table.php
@@ -287,7 +287,7 @@ class WP_MS_Themes_List_Table extends WP_List_Table {
 		}
 
 		if ( current_user_can('edit_themes') )
-			$actions['edit'] = '<a href="' . esc_url('theme-editor.php?theme=' .  $theme_key ) . '" title="' . esc_attr__('Open this theme in the Theme Editor') . '" class="edit">' . __('Edit') . '</a>';
+			$actions['edit'] = '<a href="' . esc_url('theme-editor.php?theme=' . urlencode( $theme_key ) ) . '" title="' . esc_attr__('Open this theme in the Theme Editor') . '" class="edit">' . __('Edit') . '</a>';
 
 		if ( ! $allowed && current_user_can( 'delete_themes' ) && ! $this->is_site_themes && $theme_key != get_option( 'stylesheet' ) && $theme_key != get_option( 'template' ) )
 			$actions['delete'] = '<a href="' . esc_url( wp_nonce_url( 'themes.php?action=delete-selected&amp;checked[]=' . $theme_key . '&amp;theme_status=' . $context . '&amp;paged=' . $page . '&amp;s=' . $s, 'bulk-themes' ) ) . '" title="' . esc_attr__( 'Delete this theme' ) . '" class="delete">' . __( 'Delete' ) . '</a>';
diff --git a/wp-admin/includes/class-wp-themes-list-table.php b/wp-admin/includes/class-wp-themes-list-table.php
index 8c54109d3f..59942e22f3 100644
--- a/wp-admin/includes/class-wp-themes-list-table.php
+++ b/wp-admin/includes/class-wp-themes-list-table.php
@@ -128,7 +128,7 @@ class WP_Themes_List_Table extends WP_List_Table {
 			$activate_link = wp_nonce_url( "themes.php?action=activate&amp;template=" . urlencode( $template ) . "&amp;stylesheet=" . urlencode( $stylesheet ), 'switch-theme_' . $stylesheet );
 
 			$preview_link = esc_url( add_query_arg(
-				array( 'preview' => 1, 'template' => $template, 'stylesheet' => $stylesheet, 'preview_iframe' => true, 'TB_iframe' => 'true' ),
+				array( 'preview' => 1, 'template' => urlencode( $template ), 'stylesheet' => urlencode( $stylesheet ), 'preview_iframe' => true, 'TB_iframe' => 'true' ),
 				home_url( '/' ) ) );
 
 			$actions = array();
diff --git a/wp-admin/includes/class-wp-upgrader.php b/wp-admin/includes/class-wp-upgrader.php
index d1a3433339..bf7e8422be 100644
--- a/wp-admin/includes/class-wp-upgrader.php
+++ b/wp-admin/includes/class-wp-upgrader.php
@@ -1500,14 +1500,14 @@ class Theme_Installer_Skin extends WP_Upgrader_Skin {
 
 		$preview_link = add_query_arg( array(
 			'preview'    => 1,
-			'template'   => $template,
-			'stylesheet' => $stylesheet,
+			'template'   => urlencode( $template ),
+			'stylesheet' => urlencode( $stylesheet ),
 		), trailingslashit( get_home_url() ) );
 
 		$activate_link = add_query_arg( array(
 			'action'     => 'activate',
-			'template'   => $template,
-			'stylesheet' => $stylesheet,
+			'template'   => urlencode( $template ),
+			'stylesheet' => urlencode( $stylesheet ),
 		), admin_url('themes.php') );
 		$activate_link = wp_nonce_url( $activate_link, 'switch-theme_' . $stylesheet );
 
@@ -1564,14 +1564,14 @@ class Theme_Upgrader_Skin extends WP_Upgrader_Skin {
 
 			$preview_link = add_query_arg( array(
 				'preview'    => 1,
-				'template'   => $template,
-				'stylesheet' => $stylesheet,
+				'template'   => urlencode( $template ),
+				'stylesheet' => urlencode( $stylesheet ),
 			), trailingslashit( get_home_url() ) );
 
 			$activate_link = add_query_arg( array(
 				'action'     => 'activate',
-				'template'   => $template,
-				'stylesheet' => $stylesheet,
+				'template'   => urlencode( $template ),
+				'stylesheet' => urlencode( $stylesheet ),
 			), admin_url('themes.php') );
 			$activate_link = wp_nonce_url( $activate_link, 'switch-theme_' . $stylesheet );