diff --git a/src/wp-includes/post-template.php b/src/wp-includes/post-template.php
index bac6a507bc..164001e716 100644
--- a/src/wp-includes/post-template.php
+++ b/src/wp-includes/post-template.php
@@ -454,7 +454,7 @@ function has_excerpt( $post = 0 ) {
  */
 function post_class( $class = '', $post_id = null ) {
 	// Separates classes with a single space, collates classes for post DIV.
-	echo 'class="' . join( ' ', get_post_class( $class, $post_id ) ) . '"';
+	echo 'class="' . esc_attr( join( ' ', get_post_class( $class, $post_id ) ) ) . '"';
 }
 
 /**
@@ -590,7 +590,7 @@ function get_post_class( $class = '', $post_id = null ) {
  */
 function body_class( $class = '' ) {
 	// Separates class names with a single space, collates class names for body element.
-	echo 'class="' . join( ' ', get_body_class( $class ) ) . '"';
+	echo 'class="' . esc_attr( join( ' ', get_body_class( $class ) ) ) . '"';
 }
 
 /**
diff --git a/tests/phpunit/tests/post/bodyClass.php b/tests/phpunit/tests/post/bodyClass.php
new file mode 100644
index 0000000000..dbe65fcd1a
--- /dev/null
+++ b/tests/phpunit/tests/post/bodyClass.php
@@ -0,0 +1,29 @@
+<?php
+
+/**
+ * @group post
+ * @covers ::body_class
+ */
+class Tests_Post_BodyClass extends WP_UnitTestCase {
+	protected $post_id;
+
+	public function setUp() {
+		parent::setUp();
+		$this->post_id = self::factory()->post->create();
+	}
+
+	public function test_body_class() {
+		$expected = 'class="' . join( ' ', get_body_class( '', $this->post_id ) ) . '"';
+		$this->expectOutputString( $expected );
+		body_class( '', $this->post_id );
+	}
+
+	public function test_body_class_extra_esc_attr() {
+		$classes              = get_body_class( '', $this->post_id );
+		$escaped_again        = array_map( 'esc_attr', $classes );
+		$escaped_another_time = 'class="' . esc_attr( join( ' ', $escaped_again ) ) . '"';
+
+		$this->expectOutputString( $escaped_another_time );
+		body_class( '', $this->post_id );
+	}
+}
diff --git a/tests/phpunit/tests/post/postClass.php b/tests/phpunit/tests/post/postClass.php
new file mode 100644
index 0000000000..f8501e9dc1
--- /dev/null
+++ b/tests/phpunit/tests/post/postClass.php
@@ -0,0 +1,29 @@
+<?php
+
+/**
+ * @group post
+ * @covers ::post_class
+ */
+class Tests_Post_PostClass extends WP_UnitTestCase {
+	protected $post_id;
+
+	public function setUp() {
+		parent::setUp();
+		$this->post_id = self::factory()->post->create();
+	}
+
+	public function test_post_class() {
+		$expected = 'class="' . join( ' ', get_post_class( '', $this->post_id ) ) . '"';
+		$this->expectOutputString( $expected );
+		post_class( '', $this->post_id );
+	}
+
+	public function test_post_class_extra_esc_attr() {
+		$classes              = get_post_class( '', $this->post_id );
+		$escaped_again        = array_map( 'esc_attr', $classes );
+		$escaped_another_time = 'class="' . esc_attr( join( ' ', $escaped_again ) ) . '"';
+
+		$this->expectOutputString( $escaped_another_time );
+		post_class( '', $this->post_id );
+	}
+}