Bug report

Summary

In TV caption you can specify html tags that are not escaped. Maybe for other elements it is relevant too.

Step to reproduce

Add: <script>alert('xss');</script> in TV caption and edit the resource with this TV.

Environment

MODX 2.x, MODX 3.x