diff --git a/wp-includes/version.php b/wp-includes/version.php
index 3dcc84b7a0..c6464d62c6 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -4,7 +4,7 @@
*
* @global string $wp_version
*/
-$wp_version = '4.6-alpha-37473';
+$wp_version = '4.6-alpha-37474';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
diff --git a/wp-login.php b/wp-login.php
index 96eef5b27d..1c2428217f 100644
--- a/wp-login.php
+++ b/wp-login.php
@@ -294,7 +294,7 @@ function retrieve_password() {
if ( empty( $_POST['user_login'] ) ) {
$errors->add('empty_username', __('ERROR: Enter a username or email address.'));
} elseif ( strpos( $_POST['user_login'], '@' ) ) {
- $user_data = get_user_by( 'email', trim( $_POST['user_login'] ) );
+ $user_data = get_user_by( 'email', trim( wp_unslash( $_POST['user_login'] ) ) );
if ( empty( $user_data ) )
$errors->add('invalid_email', __('ERROR: There is no user registered with that email address.'));
} else {