@faishal does `esc_attr` make sense here? It's not being output in any HTML attribute, and `WP_User_Query` should be doing any requisite escaping. And actually, it needs a `wp_unslash()` here too.