diff --git a/wp-includes/pluggable.php b/wp-includes/pluggable.php
index 084f24a95b..103b5445c8 100644
--- a/wp-includes/pluggable.php
+++ b/wp-includes/pluggable.php
@@ -260,7 +260,10 @@ if ( !function_exists('wp_redirect') ) :
 function wp_redirect($location) {
 	global $is_IIS;
 
-	$location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:]|i', '', $location);
+	$location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%]|i', '', $location);
+
+	$strip = array('%0d', '%0a');
+	$location = str_replace($strip, '', $location);
 
 	if ($is_IIS)
 		header("Refresh: 0;url=$location");