Security Issue: An unprivileged user is allowed to use HTML/JavaScript in his/her profile

Any registered user with "View" rights only is still able to use HTML-related features of Wiki Syntax ({{html} }, (% style="..." %) etc.) in all fields of the profile (including first/last name, company, phone...).

This can be used to create a profile worm that will be executed whenever the profile is viewed by another user (with possibly higher privileges).