WordPress Core is vulnerable to Stored Cross-Site Scripting via the wpautop() function in various versions up to, and including, 7.1 due to a paragraph-unwrapping regular expression ('<p><blockquote([^>]*)>') that mishandles a blockquote whose attribute region contains a '>'. Combined with wpautop's blank-line paragraph splitting, a newline placed inside a blockquote cite value causes a paragraph tag to be relocated into the tag. This makes it possible for unauthenticated attackers to inject web scripts via comment content, though the comment may be subject to moderation approval before it is stored and rendered.