@@ -81,10 +81,10 @@ function render_block_core_post_date( $attributes, $content, $block ) {
 
 	$wrapper_attributes = get_block_wrapper_attributes( array( 'class' => implode( ' ', $classes ) ) );
 
-	$time_tag = sprintf( '<time datetime="%1$s">%2$s</time>', $unformatted_date, $formatted_date );
+	$time_tag = sprintf( '<time datetime="%1$s">%2$s</time>', esc_attr( $unformatted_date ), esc_html( $formatted_date ) );
 
 	if ( isset( $attributes['isLink'] ) && $attributes['isLink'] && isset( $block->context['postId'] ) ) {
-		$time_tag = sprintf( '<a href="%1s">%2s</a>', get_the_permalink( $block->context['postId'] ), $time_tag );
+		$time_tag = sprintf( '<a href="%1$s">%2$s</a>', esc_url( get_the_permalink( $block->context['postId'] ) ), $time_tag );
 	}
 
 	return sprintf( '<div %1$s>%2$s</div>', $wrapper_attributes, $time_tag );
Original file line number	Diff line number	Diff line change
`@@ -81,10 +81,10 @@ function render_block_core_post_date( $attributes, $content, $block ) {`
`81`	`81`
`82`	`82`	`$wrapper_attributes = get_block_wrapper_attributes( array( 'class' => implode( ' ', $classes ) ) );`
`83`	`83`
`84`		`- $time_tag = sprintf( '<time datetime="%1$s">%2$s</time>', $unformatted_date, $formatted_date );`
	`84`	`+ $time_tag = sprintf( '<time datetime="%1$s">%2$s</time>', esc_attr( $unformatted_date ), esc_html( $formatted_date ) );`
`85`	`85`
`86`	`86`	`if ( isset( $attributes['isLink'] ) && $attributes['isLink'] && isset( $block->context['postId'] ) ) {`
`87`		`- $time_tag = sprintf( '<a href="%1s">%2s</a>', get_the_permalink( $block->context['postId'] ), $time_tag );`
	`87`	`+ $time_tag = sprintf( '<a href="%1$s">%2$s</a>', esc_url( get_the_permalink( $block->context['postId'] ) ), $time_tag );`
`88`	`88`	`}`
`89`	`89`
`90`	`90`	`return sprintf( '<div %1$s>%2$s</div>', $wrapper_attributes, $time_tag );`