From 81b255d946e9011cd313339be74057ba587be415 Mon Sep 17 00:00:00 2001
From: Jon Surrell <sirreal@users.noreply.github.com>
Date: Thu, 11 Jun 2026 23:18:45 +0200
Subject: [PATCH 01/10] HTML API: Preserve raw text contents in serialize.

The serializer was discarding the raw-text contents of IFRAME, NOEMBED, and NOFRAMES even though get_modifiable_text() already returns the browser-equivalent raw text for those elements.

Let those elements follow the same raw emission path as SCRIPT and STYLE, preserving contents while retaining existing NUL and newline normalization.

See #65372.
---
 .../html-api/class-wp-html-processor.php      |  3 --
 .../html-api/wpHtmlProcessor-serialize.php    | 30 +++++++++++++++++++
 2 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/src/wp-includes/html-api/class-wp-html-processor.php b/src/wp-includes/html-api/class-wp-html-processor.php
index 35d91fad3129c..1c1499c298a33 100644
--- a/src/wp-includes/html-api/class-wp-html-processor.php
+++ b/src/wp-includes/html-api/class-wp-html-processor.php
@@ -1493,9 +1493,6 @@ public function serialize_token(): string {
 				case 'IFRAME':
 				case 'NOEMBED':
 				case 'NOFRAMES':
-					$text = '';
-					break;
-
 				case 'SCRIPT':
 				case 'STYLE':
 					break;
diff --git a/tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php b/tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php
index e516addb6c314..7016cff756a4a 100644
--- a/tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php
+++ b/tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php
@@ -134,6 +134,36 @@ public function test_style_contents_are_not_escaped() {
 		);
 	}
 
+	/**
+	 * Ensures that IFRAME, NOEMBED, and NOFRAMES contents are not escaped, as they are not parsed like text nodes are.
+	 *
+	 * @ticket 65372
+	 *
+	 * @dataProvider data_raw_text_elements_with_unescaped_contents
+	 *
+	 * @param string $tag_name Tag name under test.
+	 */
+	public function test_iframe_noembed_noframes_contents_are_not_escaped( string $tag_name ) {
+		$this->assertSame(
+			WP_HTML_Processor::normalize( "<{$tag_name}>apples > or\x00anges < p &amp;</{$tag_name}>" ),
+			"<{$tag_name}>apples > or\u{FFFD}anges < p &amp;</{$tag_name}>",
+			"Should have preserved text inside an {$tag_name} element, except for replacing NULL bytes."
+		);
+	}
+
+	/**
+	 * Data provider.
+	 *
+	 * @return array[]
+	 */
+	public static function data_raw_text_elements_with_unescaped_contents() {
+		return array(
+			'IFRAME'   => array( 'iframe' ),
+			'NOEMBED'  => array( 'noembed' ),
+			'NOFRAMES' => array( 'noframes' ),
+		);
+	}
+
 	public function test_unexpected_closing_tags_are_removed() {
 		$this->assertSame(
 			WP_HTML_Processor::normalize( 'one</div>two</span>three' ),

From 2f02318d2095ce4b6e2a974a61ec7e2fb3c165ff Mon Sep 17 00:00:00 2001
From: Jon Surrell <sirreal@users.noreply.github.com>
Date: Fri, 12 Jun 2026 11:24:16 +0200
Subject: [PATCH 02/10] HTML API: Expand rawtext serialize coverage

---
 .../html-api/wpHtmlProcessor-serialize.php    | 128 ++++++++++++++----
 1 file changed, 98 insertions(+), 30 deletions(-)

diff --git a/tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php b/tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php
index 7016cff756a4a..053d8023d4929 100644
--- a/tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php
+++ b/tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php
@@ -134,36 +134,6 @@ public function test_style_contents_are_not_escaped() {
 		);
 	}
 
-	/**
-	 * Ensures that IFRAME, NOEMBED, and NOFRAMES contents are not escaped, as they are not parsed like text nodes are.
-	 *
-	 * @ticket 65372
-	 *
-	 * @dataProvider data_raw_text_elements_with_unescaped_contents
-	 *
-	 * @param string $tag_name Tag name under test.
-	 */
-	public function test_iframe_noembed_noframes_contents_are_not_escaped( string $tag_name ) {
-		$this->assertSame(
-			WP_HTML_Processor::normalize( "<{$tag_name}>apples > or\x00anges < p &amp;</{$tag_name}>" ),
-			"<{$tag_name}>apples > or\u{FFFD}anges < p &amp;</{$tag_name}>",
-			"Should have preserved text inside an {$tag_name} element, except for replacing NULL bytes."
-		);
-	}
-
-	/**
-	 * Data provider.
-	 *
-	 * @return array[]
-	 */
-	public static function data_raw_text_elements_with_unescaped_contents() {
-		return array(
-			'IFRAME'   => array( 'iframe' ),
-			'NOEMBED'  => array( 'noembed' ),
-			'NOFRAMES' => array( 'noframes' ),
-		);
-	}
-
 	public function test_unexpected_closing_tags_are_removed() {
 		$this->assertSame(
 			WP_HTML_Processor::normalize( 'one</div>two</span>three' ),
@@ -311,10 +281,108 @@ public static function data_tokens_with_null_bytes() {
 			'Foreign content text' => array( "<svg>one\x00two</svg>", "<svg>one\u{FFFD}two</svg>" ),
 			'SCRIPT content'       => array( "<script>alert(\x00)</script>", "<script>alert(\u{FFFD})</script>" ),
 			'STYLE content'        => array( "<style>\x00 {}</style>", "<style>\u{FFFD} {}</style>" ),
+			'IFRAME content'       => array( "<iframe>a\x00b</iframe>", "<iframe>a\u{FFFD}b</iframe>" ),
+			'NOEMBED content'      => array( "<noembed>a\x00b</noembed>", "<noembed>a\u{FFFD}b</noembed>" ),
+			'NOFRAMES content'     => array( "<noframes>a\x00b</noframes>", "<noframes>a\u{FFFD}b</noframes>" ),
 			'Comment text'         => array( "<!-- \x00 -->", "<!-- \u{FFFD} -->" ),
 		);
 	}
 
+	/**
+	 * Ensures that the contents of IFRAME, NOEMBED, and NOFRAMES elements are
+	 * preserved when serializing.
+	 *
+	 * These elements contain raw text which is part of the parsed document.
+	 * Dropping it would change the document's contents across a serialize and
+	 * re-parse cycle.
+	 *
+	 * @ticket 65372
+	 *
+	 * @dataProvider data_rawtext_elements_with_contents
+	 *
+	 * @param string $html Normalized HTML containing a rawtext element with contents.
+	 */
+	public function test_rawtext_element_contents_are_preserved_when_normalizing( string $html ) {
+		$this->assertSame(
+			$html,
+			WP_HTML_Processor::normalize( $html ),
+			'Should have preserved the rawtext element contents.'
+		);
+	}
+
+	/**
+	 * Data provider.
+	 *
+	 * @return array[]
+	 */
+	public static function data_rawtext_elements_with_contents() {
+		return array(
+			'IFRAME with following text'        => array( '<iframe>x</iframe>y' ),
+			'NOEMBED with following text'       => array( '<noembed>x</noembed>y' ),
+			'NOFRAMES with following text'      => array( '<section><noframes>x</noframes>y</section>' ),
+			'NOFRAMES before comment'           => array( '<section><noframes>x</noframes><!----></section>' ),
+			'IFRAME with markup-like contents'  => array( '<iframe><div>inert</div></iframe>' ),
+			'NOEMBED with character reference'  => array( '<noembed>&amp;</noembed>' ),
+			'NOFRAMES with character reference' => array( '<noframes>&lt;</noframes>' ),
+		);
+	}
+
+	/**
+	 * Ensures that the contents of IFRAME, NOEMBED, and NOFRAMES elements are
+	 * preserved when serializing full documents, including NOFRAMES elements
+	 * in the HEAD or after a FRAMESET.
+	 *
+	 * @ticket 65372
+	 *
+	 * @dataProvider data_full_documents_with_rawtext_elements
+	 *
+	 * @param string $html     Input HTML document.
+	 * @param string $expected Expected serialization of the full document.
+	 */
+	public function test_rawtext_element_contents_are_preserved_in_full_documents( string $html, string $expected ) {
+		$processor = WP_HTML_Processor::create_full_parser( $html );
+
+		$this->assertSame(
+			$expected,
+			$processor->serialize(),
+			'Should have preserved the rawtext element contents.'
+		);
+	}
+
+	/**
+	 * Data provider.
+	 *
+	 * @return array[]
+	 */
+	public static function data_full_documents_with_rawtext_elements() {
+		return array(
+			'IFRAME in BODY'          => array(
+				'<iframe>x</iframe>y',
+				'<html><head></head><body><iframe>x</iframe>y</body></html>',
+			),
+			'NOEMBED in BODY'         => array(
+				'a<noembed>x</noembed>',
+				'<html><head></head><body>a<noembed>x</noembed></body></html>',
+			),
+			'NOFRAMES in BODY'        => array(
+				'a<noframes>x</noframes>',
+				'<html><head></head><body>a<noframes>x</noframes></body></html>',
+			),
+			'NOFRAMES in HEAD'        => array(
+				'<head><noframes>x</noframes></head>z',
+				'<html><head><noframes>x</noframes></head><body>z</body></html>',
+			),
+			'NOFRAMES in FRAMESET'    => array(
+				'<html><frameset><noframes>x</noframes>',
+				'<html><head></head><frameset><noframes>x</noframes></frameset></html>',
+			),
+			'IFRAME before a comment' => array(
+				'<h3><div><small><dd><iframe>x</iframe><!---->',
+				'<html><head></head><body><h3><div><small><dd><iframe>x</iframe><!----></dd></small></div></h3></body></html>',
+			),
+		);
+	}
+
 	/**
 	 * @ticket 62396
 	 *

From 7712560d9aaae51e3ebe6a5d76471bd3b0e591e0 Mon Sep 17 00:00:00 2001
From: Jon Surrell <sirreal@users.noreply.github.com>
Date: Tue, 23 Jun 2026 20:12:28 +0200
Subject: [PATCH 03/10] Combine tests with XMP rawtext

---
 .../html-api/wpHtmlProcessor-serialize.php    | 34 +++++--------------
 1 file changed, 8 insertions(+), 26 deletions(-)

diff --git a/tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php b/tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php
index cebab6bb46b53..80cd51cfd64d3 100644
--- a/tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php
+++ b/tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php
@@ -257,22 +257,6 @@ public function test_style_contents_are_not_escaped() {
 		);
 	}
 
-	/**
-	 * XMP contents are parsed using the generic raw text element parsing algorithm.
-	 * Their contents should not be escaped with HTML character references on normalization.
-	 *
-	 * @ticket 65372
-	 */
-	public function test_xmp_contents_are_not_escaped() {
-		$normalized = WP_HTML_Processor::normalize( "<xmp> < > & \" ' \x00 </xmp>" );
-
-		$this->assertSame(
-			"<xmp> < > & \" ' \u{FFFD} </xmp>",
-			$normalized,
-			'Should have preserved text inside an XMP element, except for replacing NULL bytes.'
-		);
-	}
-
 	public function test_unexpected_closing_tags_are_removed() {
 		$this->assertSame(
 			WP_HTML_Processor::normalize( 'one</div>two</span>three' ),
@@ -411,7 +395,7 @@ public function test_replaces_null_bytes_appropriately( string $html_with_nulls,
 	 *
 	 * @return array[]
 	 */
-	public static function data_tokens_with_null_bytes() {
+	public static function data_tokens_with_null_bytes(): array {
 		return array(
 			'Tag name'             => array( "<img\x00id=5>", "<img\u{FFFD}id=5></img\u{FFFD}id=5>" ),
 			'Attribute name'       => array( "<img/\x00id=5>", "<img \u{FFFD}id=\"5\">" ),
@@ -453,17 +437,15 @@ public function test_rawtext_element_contents_are_preserved_when_normalizing( st
 	/**
 	 * Data provider.
 	 *
-	 * @return array[]
+	 * @return array<string, array{string}>
 	 */
-	public static function data_rawtext_elements_with_contents() {
+	public static function data_rawtext_elements_with_contents(): array {
 		return array(
-			'IFRAME with following text'        => array( '<iframe>x</iframe>y' ),
-			'NOEMBED with following text'       => array( '<noembed>x</noembed>y' ),
-			'NOFRAMES with following text'      => array( '<section><noframes>x</noframes>y</section>' ),
-			'NOFRAMES before comment'           => array( '<section><noframes>x</noframes><!----></section>' ),
-			'IFRAME with markup-like contents'  => array( '<iframe><div>inert</div></iframe>' ),
-			'NOEMBED with character reference'  => array( '<noembed>&amp;</noembed>' ),
-			'NOFRAMES with character reference' => array( '<noframes>&lt;</noframes>' ),
+			'IFRAME'   => array( 'before<iframe> < > &amp; " \' </iframe>after' ),
+			'NOEMBED'  => array( 'before<noembed> < > &amp; " \' </noembed>after' ),
+			'NOFRAMES' => array( 'before<noframes> < > &amp; " \' </noframes>after' ),
+			'XMP'      => array( 'before<xmp> < > &amp; " \' </xmp>after' ),
+
 		);
 	}
 

From d99da2807e97515b4e3274923cf93e78cc42a2dc Mon Sep 17 00:00:00 2001
From: Jon Surrell <sirreal@users.noreply.github.com>
Date: Tue, 23 Jun 2026 20:14:33 +0200
Subject: [PATCH 04/10] Clean up and remove redundant tests

---
 .../html-api/wpHtmlProcessor-serialize.php    | 67 +------------------
 1 file changed, 3 insertions(+), 64 deletions(-)

diff --git a/tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php b/tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php
index 80cd51cfd64d3..4524472742568 100644
--- a/tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php
+++ b/tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php
@@ -413,16 +413,11 @@ public static function data_tokens_with_null_bytes(): array {
 	}
 
 	/**
-	 * Ensures that the contents of IFRAME, NOEMBED, and NOFRAMES elements are
-	 * preserved when serializing.
-	 *
-	 * These elements contain raw text which is part of the parsed document.
-	 * Dropping it would change the document's contents across a serialize and
-	 * re-parse cycle.
+	 * Ensures that contents of rawtext elements are preserved when serializing.
 	 *
 	 * @ticket 65372
 	 *
-	 * @dataProvider data_rawtext_elements_with_contents
+	 * @dataProvider data_rawtext_elements_with_html_syntax_character_contents
 	 *
 	 * @param string $html Normalized HTML containing a rawtext element with contents.
 	 */
@@ -439,7 +434,7 @@ public function test_rawtext_element_contents_are_preserved_when_normalizing( st
 	 *
 	 * @return array<string, array{string}>
 	 */
-	public static function data_rawtext_elements_with_contents(): array {
+	public static function data_rawtext_elements_with_html_syntax_character_contents(): array {
 		return array(
 			'IFRAME'   => array( 'before<iframe> < > &amp; " \' </iframe>after' ),
 			'NOEMBED'  => array( 'before<noembed> < > &amp; " \' </noembed>after' ),
@@ -449,62 +444,6 @@ public static function data_rawtext_elements_with_contents(): array {
 		);
 	}
 
-	/**
-	 * Ensures that the contents of IFRAME, NOEMBED, and NOFRAMES elements are
-	 * preserved when serializing full documents, including NOFRAMES elements
-	 * in the HEAD or after a FRAMESET.
-	 *
-	 * @ticket 65372
-	 *
-	 * @dataProvider data_full_documents_with_rawtext_elements
-	 *
-	 * @param string $html     Input HTML document.
-	 * @param string $expected Expected serialization of the full document.
-	 */
-	public function test_rawtext_element_contents_are_preserved_in_full_documents( string $html, string $expected ) {
-		$processor = WP_HTML_Processor::create_full_parser( $html );
-
-		$this->assertSame(
-			$expected,
-			$processor->serialize(),
-			'Should have preserved the rawtext element contents.'
-		);
-	}
-
-	/**
-	 * Data provider.
-	 *
-	 * @return array[]
-	 */
-	public static function data_full_documents_with_rawtext_elements() {
-		return array(
-			'IFRAME in BODY'          => array(
-				'<iframe>x</iframe>y',
-				'<html><head></head><body><iframe>x</iframe>y</body></html>',
-			),
-			'NOEMBED in BODY'         => array(
-				'a<noembed>x</noembed>',
-				'<html><head></head><body>a<noembed>x</noembed></body></html>',
-			),
-			'NOFRAMES in BODY'        => array(
-				'a<noframes>x</noframes>',
-				'<html><head></head><body>a<noframes>x</noframes></body></html>',
-			),
-			'NOFRAMES in HEAD'        => array(
-				'<head><noframes>x</noframes></head>z',
-				'<html><head><noframes>x</noframes></head><body>z</body></html>',
-			),
-			'NOFRAMES in FRAMESET'    => array(
-				'<html><frameset><noframes>x</noframes>',
-				'<html><head></head><frameset><noframes>x</noframes></frameset></html>',
-			),
-			'IFRAME before a comment' => array(
-				'<h3><div><small><dd><iframe>x</iframe><!---->',
-				'<html><head></head><body><h3><div><small><dd><iframe>x</iframe><!----></dd></small></div></h3></body></html>',
-			),
-		);
-	}
-
 	/**
 	 * @ticket 62396
 	 *

From d2c76f6e5034dcaa1739f6a6cbf7c9d2fafd0b02 Mon Sep 17 00:00:00 2001
From: Jon Surrell <sirreal@users.noreply.github.com>
Date: Wed, 24 Jun 2026 13:05:15 +0200
Subject: [PATCH 05/10] Remove empty line

---
 tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php b/tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php
index 4524472742568..b25ea9b9db00c 100644
--- a/tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php
+++ b/tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php
@@ -440,7 +440,6 @@ public static function data_rawtext_elements_with_html_syntax_character_contents
 			'NOEMBED'  => array( 'before<noembed> < > &amp; " \' </noembed>after' ),
 			'NOFRAMES' => array( 'before<noframes> < > &amp; " \' </noframes>after' ),
 			'XMP'      => array( 'before<xmp> < > &amp; " \' </xmp>after' ),
-
 		);
 	}
 

From 1018e334a9bc73948d0373fb78f3ebbe7dcc600b Mon Sep 17 00:00:00 2001
From: Jon Surrell <sirreal@users.noreply.github.com>
Date: Wed, 24 Jun 2026 13:07:47 +0200
Subject: [PATCH 06/10] Improve test function typing

Co-authored-by: Jon Surrell <sirreal@users.noreply.github.com>
---
 tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php b/tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php
index b25ea9b9db00c..80e1d0dba404d 100644
--- a/tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php
+++ b/tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php
@@ -393,7 +393,7 @@ public function test_replaces_null_bytes_appropriately( string $html_with_nulls,
 	/**
 	 * Data provider.
 	 *
-	 * @return array[]
+	 * @return array<string, array{string, string}>
 	 */
 	public static function data_tokens_with_null_bytes(): array {
 		return array(
@@ -421,7 +421,7 @@ public static function data_tokens_with_null_bytes(): array {
 	 *
 	 * @param string $html Normalized HTML containing a rawtext element with contents.
 	 */
-	public function test_rawtext_element_contents_are_preserved_when_normalizing( string $html ) {
+	public function test_rawtext_element_contents_are_preserved_when_normalizing( string $html ): void {
 		$this->assertSame(
 			$html,
 			WP_HTML_Processor::normalize( $html ),

From 7a5300d160ea24cc59cd6465d1987f8c398d15d3 Mon Sep 17 00:00:00 2001
From: Jon Surrell <sirreal@users.noreply.github.com>
Date: Thu, 9 Jul 2026 19:34:43 +0200
Subject: [PATCH 07/10] HTML API: Allow rawtext modifiable text updates

---
 .../html-api/class-wp-html-tag-processor.php      | 15 +++++++++++++++
 .../html-api/wpHtmlTagProcessorModifiableText.php |  6 ++++++
 2 files changed, 21 insertions(+)

diff --git a/src/wp-includes/html-api/class-wp-html-tag-processor.php b/src/wp-includes/html-api/class-wp-html-tag-processor.php
index e41e1120550b5..9bdb8c54d3dd6 100644
--- a/src/wp-includes/html-api/class-wp-html-tag-processor.php
+++ b/src/wp-includes/html-api/class-wp-html-tag-processor.php
@@ -3880,6 +3880,21 @@ public function set_modifiable_text( string $plaintext_content ): bool {
 				);
 				return true;
 
+			case 'IFRAME':
+			case 'NOEMBED':
+			case 'NOFRAMES':
+				if ( false !== stripos( $plaintext_content, "</{$this->get_tag()}" ) ) {
+					return false;
+				}
+
+				$this->lexical_updates['modifiable text'] = new WP_HTML_Text_Replacement(
+					$this->text_starts_at,
+					$this->text_length,
+					$plaintext_content
+				);
+
+				return true;
+
 			case 'STYLE':
 				$plaintext_content = preg_replace_callback(
 					'~</(?P<TAG_NAME>style)~i',
diff --git a/tests/phpunit/tests/html-api/wpHtmlTagProcessorModifiableText.php b/tests/phpunit/tests/html-api/wpHtmlTagProcessorModifiableText.php
index 4a09403b7b23e..3059392b0dc4e 100644
--- a/tests/phpunit/tests/html-api/wpHtmlTagProcessorModifiableText.php
+++ b/tests/phpunit/tests/html-api/wpHtmlTagProcessorModifiableText.php
@@ -430,6 +430,9 @@ public static function data_tokens_with_basic_modifiable_text_updates() {
 			'Text node (middle)'      => array( '<em>Bold move</em>', 2, 'yo', '<em>yo</em>' ),
 			'Text node (end)'         => array( '<img>of a dog', 2, 'of a cat', '<img>of a cat' ),
 			'Encoded text node'       => array( '<figcaption>birds and dogs</figcaption>', 2, '<birds> & <dogs>', '<figcaption>&lt;birds&gt; &amp; &lt;dogs&gt;</figcaption>' ),
+			'IFRAME tag'              => array( 'before<iframe>old content</iframe>after', 2, '<p>raw & text</p>', 'before<iframe><p>raw & text</p></iframe>after' ),
+			'NOEMBED tag'             => array( 'before<noembed>old content</noembed>after', 2, '<p>raw & text</p>', 'before<noembed><p>raw & text</p></noembed>after' ),
+			'NOFRAMES tag'            => array( 'before<noframes>old content</noframes>after', 2, '<p>raw & text</p>', 'before<noframes><p>raw & text</p></noframes>after' ),
 			'SCRIPT tag'              => array( 'before<script></script>after', 2, 'const img = "<img> & <br>";', 'before<script>const img = "<img> & <br>";</script>after' ),
 			'STYLE tag'               => array( '<style></style>', 1, 'p::before { content: "<img> & </style>"; }', '<style>p::before { content: "<img> & \3c\2fstyle>"; }</style>' ),
 			'TEXTAREA tag'            => array( 'a<textarea>has no need to escape</textarea>b', 2, "so it <doesn't>", "a<textarea>so it <doesn't></textarea>b" ),
@@ -490,6 +493,9 @@ public static function data_unallowed_modifiable_text_updates() {
 		return array(
 			'Comment with -->'                        => array( '<!-- this is a comment -->', 'Comments end in -->' ),
 			'Comment with --!>'                       => array( '<!-- this is a comment -->', 'Invalid but legitimate comments end in --!>' ),
+			'IFRAME with </iframe>'                   => array( '<iframe>Replace me</iframe>', 'Just a </iframe>' ),
+			'NOEMBED with </NOEMBED>'                 => array( '<noembed>Replace me</noembed>', 'Just a </NOEMBED>' ),
+			'NOFRAMES with </noframes attributes>'    => array( '<noframes>Replace me</noframes>', 'before</noframes sneaky>after' ),
 			'Non-JS SCRIPT with <script>'             => array( '<script type="text/html">Replace me</script>', '<!-- Just a <script>' ),
 			'Non-JS SCRIPT with </script>'            => array( '<script type="text/plain">Replace me</script>', 'Just a </script>' ),
 			'Non-JS SCRIPT with <script attributes>'  => array( '<script language="text">Replace me</script>', '<!-- <script sneaky>after' ),

From edb2273f380ca6f3aa57e59bf9e59070e0c0e04d Mon Sep 17 00:00:00 2001
From: Jon Surrell <sirreal@users.noreply.github.com>
Date: Mon, 13 Jul 2026 15:41:36 +0200
Subject: [PATCH 08/10] Add _doing_it_wrong

---
 .../html-api/class-wp-html-tag-processor.php         | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/wp-includes/html-api/class-wp-html-tag-processor.php b/src/wp-includes/html-api/class-wp-html-tag-processor.php
index da040c423598b..f6f6c89559d64 100644
--- a/src/wp-includes/html-api/class-wp-html-tag-processor.php
+++ b/src/wp-includes/html-api/class-wp-html-tag-processor.php
@@ -4078,7 +4078,17 @@ public function set_modifiable_text( string $plaintext_content ): bool {
 			case 'IFRAME':
 			case 'NOEMBED':
 			case 'NOFRAMES':
-				if ( false !== stripos( $plaintext_content, "</{$this->get_tag()}" ) ) {
+				$tag_name = $this->get_tag();
+				if ( false !== stripos( $plaintext_content, "</{$tag_name}" ) ) {
+					_doing_it_wrong(
+						__METHOD__,
+						sprintf(
+							/* translators: %s: HTML tag name. */
+							__( '%s text cannot contain its own closing tag.' ),
+							$tag_name
+						),
+						'7.1.0'
+					);
 					return false;
 				}
 

From 14f2d8850d14b7208837c5b23213770c4454738e Mon Sep 17 00:00:00 2001
From: Jon Surrell <sirreal@users.noreply.github.com>
Date: Mon, 13 Jul 2026 17:03:52 +0200
Subject: [PATCH 09/10] HTML API: Support XMP modifiable text updates

---
 src/wp-includes/html-api/class-wp-html-tag-processor.php       | 3 ++-
 .../tests/html-api/wpHtmlTagProcessorModifiableText.php        | 2 ++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/wp-includes/html-api/class-wp-html-tag-processor.php b/src/wp-includes/html-api/class-wp-html-tag-processor.php
index f6f6c89559d64..e5fcfd7fe9118 100644
--- a/src/wp-includes/html-api/class-wp-html-tag-processor.php
+++ b/src/wp-includes/html-api/class-wp-html-tag-processor.php
@@ -298,7 +298,7 @@
  *    closing the SCRIPT from inside a JavaScript string. E.g. `console.log( '</script>' )`.
  *  - `TITLE` and `TEXTAREA` whose contents are treated as plaintext and then any
  *    character references are decoded. E.g. `1 &lt; 2 < 3` becomes `1 < 2 < 3`.
- *  - `IFRAME`, `NOEMBED`, `NOFRAMES`, `STYLE` whose contents are treated as
+ *  - `IFRAME`, `NOEMBED`, `NOFRAMES`, `STYLE`, `XMP` whose contents are treated as
  *    raw plaintext and left as-is. E.g. `1 &lt; 2 < 3` remains `1 &lt; 2 < 3`.
  *
  * #### Other tokens with modifiable text.
@@ -4078,6 +4078,7 @@ public function set_modifiable_text( string $plaintext_content ): bool {
 			case 'IFRAME':
 			case 'NOEMBED':
 			case 'NOFRAMES':
+			case 'XMP':
 				$tag_name = $this->get_tag();
 				if ( false !== stripos( $plaintext_content, "</{$tag_name}" ) ) {
 					_doing_it_wrong(
diff --git a/tests/phpunit/tests/html-api/wpHtmlTagProcessorModifiableText.php b/tests/phpunit/tests/html-api/wpHtmlTagProcessorModifiableText.php
index e85fe73600c43..589318daf3a70 100644
--- a/tests/phpunit/tests/html-api/wpHtmlTagProcessorModifiableText.php
+++ b/tests/phpunit/tests/html-api/wpHtmlTagProcessorModifiableText.php
@@ -437,6 +437,7 @@ public static function data_tokens_with_basic_modifiable_text_updates() {
 			'IFRAME tag'              => array( 'before<iframe>old content</iframe>after', 2, '<p>raw & text</p>', 'before<iframe><p>raw & text</p></iframe>after' ),
 			'NOEMBED tag'             => array( 'before<noembed>old content</noembed>after', 2, '<p>raw & text</p>', 'before<noembed><p>raw & text</p></noembed>after' ),
 			'NOFRAMES tag'            => array( 'before<noframes>old content</noframes>after', 2, '<p>raw & text</p>', 'before<noframes><p>raw & text</p></noframes>after' ),
+			'XMP tag'                 => array( 'before<xmp>old content</xmp>after', 2, '<p>raw & text</p>', 'before<xmp><p>raw & text</p></xmp>after' ),
 			'SCRIPT tag'              => array( 'before<script></script>after', 2, 'const img = "<img> & <br>";', 'before<script>const img = "<img> & <br>";</script>after' ),
 			'STYLE tag'               => array( '<style></style>', 1, 'p::before { content: "<img> & </style>"; }', '<style>p::before { content: "<img> & \3c\2fstyle>"; }</style>' ),
 			'TEXTAREA tag'            => array( 'a<textarea>has no need to escape</textarea>b', 2, "so it <doesn't>", "a<textarea>so it <doesn't></textarea>b" ),
@@ -630,6 +631,7 @@ public static function data_unallowed_modifiable_text_updates() {
 			'IFRAME with </iframe>'                   => array( '<iframe>Replace me</iframe>', 'Just a </iframe>' ),
 			'NOEMBED with </NOEMBED>'                 => array( '<noembed>Replace me</noembed>', 'Just a </NOEMBED>' ),
 			'NOFRAMES with </noframes attributes>'    => array( '<noframes>Replace me</noframes>', 'before</noframes sneaky>after' ),
+			'XMP with </xmp>'                         => array( '<xmp>Replace me</xmp>', 'Just a </xmp>' ),
 			'PI with >'                               => array( '<?wp-bit some data?>', 'Processing instructions end at the first >' ),
 			'PI with leading space'                   => array( '<?wp-bit some data?>', ' leading whitespace is skipped after the target' ),
 			'PI with leading tab'                     => array( '<?wp-bit some data?>', "\tleading whitespace is skipped after the target" ),

From 89bc63112df46ff370acdfb636ee7b6d1e3a4286 Mon Sep 17 00:00:00 2001
From: Jon Surrell <sirreal@users.noreply.github.com>
Date: Mon, 13 Jul 2026 17:05:15 +0200
Subject: [PATCH 10/10] HTML API: Generalize unsupported modifiable text
 message

---
 src/wp-includes/html-api/class-wp-html-tag-processor.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/wp-includes/html-api/class-wp-html-tag-processor.php b/src/wp-includes/html-api/class-wp-html-tag-processor.php
index e5fcfd7fe9118..ace3e14bea565 100644
--- a/src/wp-includes/html-api/class-wp-html-tag-processor.php
+++ b/src/wp-includes/html-api/class-wp-html-tag-processor.php
@@ -4158,7 +4158,7 @@ static function ( $tag_match ) {
 
 		_doing_it_wrong(
 			__METHOD__,
-			__( 'Only the SCRIPT, STYLE, TEXTAREA, and TITLE tags support setting modifiable text.' ),
+			__( 'This tag does not support setting modifiable text.' ),
 			'7.1.0'
 		);
 		return false;