Should messages in WP_Error already be html escaped?
No, escaping should happen at the moment of output ( late escaping ) so that we know that it only occurs once. Double escaping can allow specially crafted output to break out. By escaping, we’re talking about functions such as esc_html, wp_kses_post, esc_url, etc. Sanitizing functions and validating functions are not the same, e.g. sanitize_textfield. … Read more