diff --git a/mod/quiz/db/access.php b/mod/quiz/db/access.php
index 18f02d69303..a072f11e826 100644
--- a/mod/quiz/db/access.php
+++ b/mod/quiz/db/access.php
@@ -65,7 +65,7 @@ $mod_quiz_capabilities = array(
 
     // Manually grade and comment on student attempts at a question, and regrade quizzes.
     'mod/quiz:grade' => array(
-        'riskbitmask' => RISK_SPAM | RISK_XSS,
+        'riskbitmask' => RISK_SPAM,
         'captype' => 'write',
         'contextlevel' => CONTEXT_MODULE,
         'legacy' => array(
diff --git a/question/type/questiontype.php b/question/type/questiontype.php
index 7d78b5a5f8a..605ed52f132 100644
--- a/question/type/questiontype.php
+++ b/question/type/questiontype.php
@@ -874,7 +874,10 @@ class default_questiontype {
             $grade .= $question->maxgrade;
         }
 
-        $comment = stripslashes($state->manualcomment);
+        $formatoptions = new stdClass;
+        $formatoptions->para = false;
+        $comment = format_text(stripslashes($state->manualcomment), FORMAT_HTML,
+                $formatoptions, $cmoptions->course);
         $commentlink = '';
 
         if (!empty($options->questioncommentlink)) {