Steps to reproduce the issue

1. Login to Joomla admin.
2. Go to Articles and click on New to create a new Article.
3. Enter Title
4. In Article text Enter some text e.g. "This is a test article"
5. Before saving start burp suite and then hit on save. The request will be captured by burp suite.
6. Go to Burp suite and go to "Params" tab and change the article text from "This is a test article" to "<svg onload=alert(1)>" and click on "Forward" till the article gets saved.
7. Now switch off the intercept on Burp suite and go to the joomla frontend and login with a user.
8. And click on the articles menu to view the article.
9. Once user clicks on article and the script gets executed.

Expected result

The article shouldn't get saved with the script tag.

Actual result

The article getting saved with the script tag and the script is getting executed on user side.

System information (as much as possible)

PHP 7.2
Joomla 4.0.0-alpha12-dev