diff -r 34716fd837a4 -r be944660c56a wp/wp-admin/network/user-new.php
--- a/wp/wp-admin/network/user-new.php	Tue Dec 15 15:52:01 2020 +0100
+++ b/wp/wp-admin/network/user-new.php	Wed Sep 21 18:19:35 2022 +0200
@@ -122,7 +122,7 @@
 		?>
 	</div>
 <?php } ?>
-	<form action="<?php echo network_admin_url( 'user-new.php?action=add-user' ); ?>" id="adduser" method="post" novalidate="novalidate">
+	<form action="<?php echo esc_url( network_admin_url( 'user-new.php?action=add-user' ) ); ?>" id="adduser" method="post" novalidate="novalidate">
 	<table class="form-table" role="presentation">
 		<tr class="form-field form-required">
 			<th scope="row"><label for="username"><?php _e( 'Username' ); ?></label></th>
@@ -130,7 +130,7 @@
 		</tr>
 		<tr class="form-field form-required">
 			<th scope="row"><label for="email"><?php _e( 'Email' ); ?></label></th>
-			<td><input type="email" class="regular-text" name="user[email]" id="email"/></td>
+			<td><input type="email" class="regular-text" name="user[email]" id="email" /></td>
 		</tr>
 		<tr class="form-field">
 			<td colspan="2" class="td-full"><?php _e( 'A password reset link will be sent to the user via email.' ); ?></td>