diff -r 7b1b88e27a20 -r 48c4eec2b7e6 wp/wp-includes/widgets/class-wp-nav-menu-widget.php
--- a/wp/wp-includes/widgets/class-wp-nav-menu-widget.php	Thu Sep 29 08:06:27 2022 +0200
+++ b/wp/wp-includes/widgets/class-wp-nav-menu-widget.php	Fri Sep 05 18:40:08 2025 +0200
@@ -137,8 +137,9 @@
 	 *
 	 * @since 3.0.0
 	 *
+	 * @global WP_Customize_Manager $wp_customize
+	 *
 	 * @param array $instance Current settings.
-	 * @global WP_Customize_Manager $wp_customize
 	 */
 	public function form( $instance ) {
 		global $wp_customize;
@@ -171,8 +172,12 @@
 				$url = admin_url( 'nav-menus.php' );
 			}
 
-			/* translators: %s: URL to create a new menu. */
-			printf( __( 'No menus have been created yet. <a href="%s">Create some</a>.' ), esc_attr( $url ) );
+			printf(
+				/* translators: %s: URL to create a new menu. */
+				__( 'No menus have been created yet. <a href="%s">Create some</a>.' ),
+				// The URL can be a `javascript:` link, so esc_attr() is used here instead of esc_url().
+				esc_attr( $url )
+			);
 			?>
 		</p>
 		<div class="nav-menu-widget-form-controls" <?php echo $empty_menus_style; ?>>