Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "{{ expr }}".
<h5 class="archive-result text-color-base text-xlarge" data-message-zero="{{ i18n "global.posts_found.zero" }}" data-message-one="{{ i18n "global.posts_found.one" }}" data-message-other="{{ i18n "global.posts_found.other" }}"></h5>