diff --git a/wp-admin/press-this.php b/wp-admin/press-this.php
index 30b1bf4778..f32d35a895 100644
--- a/wp-admin/press-this.php
+++ b/wp-admin/press-this.php
@@ -582,7 +582,7 @@ var photostorage = false;
 						echo '<p>';
 						if ( $selection )
 							_e('via ');
-						echo "<a href='$url'>$title</a>.</p>";
+						printf( "<a href='%s'>%s</a>.</p>", esc_url( $url ), esc_html( $title ) );
 					}
 				?></textarea>
 			</div>