diff --git a/mod/quiz/db/access.php b/mod/quiz/db/access.php
index 21c29bc790a..ae31ddb7347 100644
--- a/mod/quiz/db/access.php
+++ b/mod/quiz/db/access.php
@@ -108,7 +108,7 @@ $capabilities = array(
 
     // Manually grade and comment on student attempts at a question.
     'mod/quiz:grade' => array(
-        'riskbitmask' => RISK_SPAM,
+        'riskbitmask' => RISK_SPAM | RISK_XSS,
         'captype' => 'write',
         'contextlevel' => CONTEXT_MODULE,
         'archetypes' => array(