Stored XSS on user profile page

1) Open user profile page and edit fields "first name", "last name", "company", "phone", "blog", "blog feed" with XSS payload, e.g. 

first_name"><img src=x onerror=alert('first_name')>

 2) Save changes, reload page

Actual result: XSS payload executes

Expected result: JS sanitized / escaped (like in "email" or "about" field)