crowdfavorite/wp-social — comment on commit 4473280b5f9b9b96173aa547f07f8e1a3a122bc5
File: views/comment/comment.php line 35
By alexkingorg:

This is an interesting case. I'm going back and forth on escaping stuff that's localized. I think the esc_ call should be the last thing done, wish sprintf inside it. The thing we want to escape here is the date, not the i18n string; though I'm not 100% sure we need to be escaping the human_time_diff output if it's sanitized in the function itself.

Check with Justin on this and see if he has thoughts.