Plugins: Escape output in error messages.

Props tykoted, paulkevan, peterwilsoncc.

git-svn-id: https://develop.svn.wordpress.org/trunk@53960 602fd350-edb4-49c9-b593-d223f7449a82

src/wp-admin/plugins.php

@@ -612,7 +612,7 @@
 			/* translators: 1: Plugin file, 2: Error message. */
 			__( 'The plugin %1$s has been deactivated due to an error: %2$s' ),
 			'<code>' . esc_html( $plugin_file ) . '</code>',
-			$error->get_error_message()
+			esc_html( $error->get_error_message() )
 		);
 		echo '</p></div>';
 	}
@@ -676,7 +676,7 @@
 				printf(
 					/* translators: %s: Error message. */
 					__( 'Plugin could not be deleted due to an error: %s' ),
-					$delete_result->get_error_message()
+					esc_html( $delete_result->get_error_message() )
 				);
 				?>
 			</p>