Markdown in WordPress needs an escaping pass
WordPress has no Markdown parser in core, so the rendering is always yours to wire up. The tempting shortcut is to echo the parsed HTML straight out. On a WordPress site that string usually comes from user input, so it needs wp_kses before it reaches the page.