html escape issues with error messages

Hi, I'm testing out the login form by adding the shortcode on a page. When login credentials are wrong, the error message shows the user something like this:

<strong>ERROR</strong>: Invalid username. <a href="https://domain.org/wp-admin/?action=lostpassword">Lost your password?</a>

instead of just:

Error: Invalid username. Lost your password?