diff --git a/wp-admin/about.php b/wp-admin/about.php
index 93942ef..54bef81 100644
--- a/wp-admin/about.php
+++ b/wp-admin/about.php
@@ -103,6 +103,26 @@
 				<?php _e(
 					'ClassicPress currently includes all changes from the following versions of WordPress:'
 				); ?>
+			<p>
+				<?php
+				printf(
+					/* translators: %s: WordPress version number */
+					__( '<strong>WordPress version %s</strong> addressed some security issues.' ),
+					'4.9.10'
+				);
+				?>
+				<?php
+				printf(
+					/* translators: %s: HelpHub URL */
+					__( 'For more information, see <a href="%s">the release notes</a>.' ),
+					sprintf(
+						/* translators: %s: WordPress version */
+						esc_url( __( 'https://wordpress.org/support/wordpress-version/version-%s/' ) ),
+						sanitize_title( '4.9.10' )
+					)
+				);
+				?>
+			</p>
 			<p>
 				<?php
 				/* translators: %s: WordPress version number */
diff --git a/wp-admin/includes/ajax-actions.php b/wp-admin/includes/ajax-actions.php
index 1bfd4a1..866b69a 100644
--- a/wp-admin/includes/ajax-actions.php
+++ b/wp-admin/includes/ajax-actions.php
@@ -1023,6 +1023,8 @@ function wp_ajax_replyto_comment( $action ) {
 			if ( wp_create_nonce( 'unfiltered-html-comment' ) != $_POST['_wp_unfiltered_html_comment'] ) {
 				kses_remove_filters(); // start with a clean slate
 				kses_init_filters(); // set up the filters
+				remove_filter( 'pre_comment_content', 'wp_filter_post_kses' );
+				add_filter( 'pre_comment_content', 'wp_filter_kses' );
 			}
 		}
 	} else {
diff --git a/wp-includes/comment.php b/wp-includes/comment.php
index 7dc1d74..725bb03 100644
--- a/wp-includes/comment.php
+++ b/wp-includes/comment.php
@@ -3110,6 +3110,8 @@ function wp_handle_comment_submission( $comment_data ) {
 			) {
 				kses_remove_filters(); // start with a clean slate
 				kses_init_filters(); // set up the filters
+				remove_filter( 'pre_comment_content', 'wp_filter_post_kses' );
+				add_filter( 'pre_comment_content', 'wp_filter_kses' );
 			}
 		}
 	} else {
diff --git a/wp-includes/formatting.php b/wp-includes/formatting.php
index 38c6fcb..bcf536e 100644
--- a/wp-includes/formatting.php
+++ b/wp-includes/formatting.php
@@ -2750,10 +2750,12 @@ function wp_rel_nofollow_callback( $matches ) {
 	$atts = shortcode_parse_atts( $matches[1] );
 	$rel  = 'nofollow';
 
-	if ( preg_match( '%href=["\'](' . preg_quote( set_url_scheme( home_url(), 'http' ) ) . ')%i', $text ) ||
-	     preg_match( '%href=["\'](' . preg_quote( set_url_scheme( home_url(), 'https' ) ) . ')%i', $text )
-	) {
-		return "<a $text>";
+	if ( ! empty( $atts['href'] ) ) {
+		if ( in_array( strtolower( wp_parse_url( $atts['href'], PHP_URL_SCHEME ) ), array( 'http', 'https' ), true ) ) {
+			if ( strtolower( wp_parse_url( $atts['href'], PHP_URL_HOST ) ) === strtolower( wp_parse_url( home_url(), PHP_URL_HOST ) ) ) {
+				return "<a $text>";
+			}
+		}
 	}
 
 	if ( ! empty( $atts['rel'] ) ) {
@@ -2766,11 +2768,11 @@ function wp_rel_nofollow_callback( $matches ) {
 
 		$html = '';
 		foreach ( $atts as $name => $value ) {
-			$html .= "{$name}=\"$value\" ";
+			$html .= "{$name}=\"" . esc_attr( $value ) . "\" ";
 		}
 		$text = trim( $html );
 	}
-	return "<a $text rel=\"$rel\">";
+	return "<a $text rel=\"" . esc_attr( $rel ) . "\">";
 }
 
 /**
diff --git a/wp-includes/script-loader.php b/wp-includes/script-loader.php
index 0574ad9..4cb1a2b 100644
--- a/wp-includes/script-loader.php
+++ b/wp-includes/script-loader.php
@@ -53,7 +53,7 @@ function classicpress_asset_version( $type = 'script', $handle = null ) {
 	static $default_version;
 
 	if ( empty( $default_version ) ) {
-		$default_version = 'cp_7f5d787c';
+		$default_version = 'cp_ecfea534';
 	}
 
 	/**
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 4eb2bf8..a39d73e 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -27,7 +27,48 @@
  *
  * @global string $cp_version
  */
-$cp_version = '1.0.0';
+$cp_version = '1.0.1';
+
+/**
+ * The WordPress version string
+ *
+ * This is still used internally for various core and plugin functions, and to
+ * keep compatibility checks working as intended.  The ClassicPress version is
+ * stored separately.
+ *
+ * @see classicpress_version()
+ *
+ * @global string $wp_version
+ */
+$wp_version = '4.9.10';
+
+/**
+ * Holds the ClassicPress DB revision, increments when changes are made to the ClassicPress DB schema.
+ *
+ * @global int $wp_db_version
+ */
+$wp_db_version = 38590;
+
+/**
+ * Holds the TinyMCE version
+ *
+ * @global string $tinymce_version
+ */
+$tinymce_version = '4800-20180716';
+
+/**
+ * Holds the required PHP version
+ *
+ * @global string $required_php_version
+ */
+$required_php_version = '5.6.0';
+
+/**
+ * Holds the required MySQL version
+ *
+ * @global string $required_mysql_version
+ */
+$required_mysql_version = '5.0';
 
 /**
  * Return the ClassicPress version string.
@@ -77,44 +118,3 @@ function classicpress_is_dev_install() {
 		return substr( $cp_version, -4 ) === '+dev';
 	}
 }
-
-/**
- * The WordPress version string
- *
- * This is still used internally for various core and plugin functions, and to
- * keep compatibility checks working as intended.  The ClassicPress version is
- * stored separately.
- *
- * @see classicpress_version()
- *
- * @global string $wp_version
- */
-$wp_version = '4.9.9';
-
-/**
- * Holds the ClassicPress DB revision, increments when changes are made to the ClassicPress DB schema.
- *
- * @global int $wp_db_version
- */
-$wp_db_version = 38590;
-
-/**
- * Holds the TinyMCE version
- *
- * @global string $tinymce_version
- */
-$tinymce_version = '4800-20180716';
-
-/**
- * Holds the required PHP version
- *
- * @global string $required_php_version
- */
-$required_php_version = '5.6.0';
-
-/**
- * Holds the required MySQL version
- *
- * @global string $required_mysql_version
- */
-$required_mysql_version = '5.0';