diff --git a/src/wp-includes/media.php b/src/wp-includes/media.php
index 6843c61b21..19eba00a6a 100644
--- a/src/wp-includes/media.php
+++ b/src/wp-includes/media.php
@@ -3098,7 +3098,11 @@ function wp_prepare_attachment_for_js( $attachment ) {
 	);
 
 	$author = new WP_User( $attachment->post_author );
-	$response['authorName'] = $author->display_name;
+	if ( $author->exists() ) {
+		$response['authorName'] = html_entity_decode( $author->display_name, ENT_QUOTES, get_bloginfo( 'charset' ) );
+	} else {
+		$response['authorName'] = __( '(no author)' );
+	}
 
 	if ( $attachment->post_parent ) {
 		$post_parent = get_post( $attachment->post_parent );
diff --git a/tests/phpunit/tests/media.php b/tests/phpunit/tests/media.php
index 6b1ec96613..bccab12d3e 100644
--- a/tests/phpunit/tests/media.php
+++ b/tests/phpunit/tests/media.php
@@ -267,6 +267,18 @@ https://w.org</a>'
 		$this->assertEquals( 'image', $prepped['mime'] );
 		$this->assertEquals( 'image', $prepped['type'] );
 		$this->assertEquals( '', $prepped['subtype'] );
+
+		// Test that if author is not found, we return "(no author)" as `display_name`.
+		// The previously used test post contains no author, so we can reuse it.
+		$this->assertEquals( '(no author)', $prepped['authorName'] );
+
+		// Test that if author has HTML entities in display_name, they're decoded correctly.
+		$html_entity_author = self::factory()->user->create( array(
+			'display_name' => 'You &amp; Me',
+		) );
+		$post->post_author = $html_entity_author;
+		$prepped = wp_prepare_attachment_for_js( $post );
+		$this->assertEquals( 'You & Me', $prepped['authorName'] );
 	}
 
 	/**