diff --git a/core/modules/config.js b/core/modules/config.js
index c82ece7a0..a7d90082b 100644
--- a/core/modules/config.js
+++ b/core/modules/config.js
@@ -37,4 +37,6 @@ exports.htmlVoidElements = "area,base,br,col,command,embed,hr,img,input,keygen,l
 
 exports.htmlBlockElements = "address,article,aside,audio,blockquote,canvas,dd,div,dl,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,hr,li,noscript,ol,output,p,pre,section,table,tfoot,ul,video".split(",");
 
+exports.htmlUnsafeElements = "script".split(",");
+
 })();
diff --git a/core/modules/widgets/element.js b/core/modules/widgets/element.js
index 3ad8a3d38..4bfbe53ad 100755
--- a/core/modules/widgets/element.js
+++ b/core/modules/widgets/element.js
@@ -30,7 +30,12 @@ ElementWidget.prototype.render = function(parent,nextSibling) {
 	this.parentDomNode = parent;
 	this.computeAttributes();
 	this.execute();
-	var domNode = this.document.createElementNS(this.namespace,this.parseTreeNode.tag);
+	// Neuter blacklisted elements
+	var tag = this.parseTreeNode.tag;
+	if($tw.config.htmlUnsafeElements.indexOf(tag) !== -1) {
+		tag = "safe-" + tag;
+	}
+	var domNode = this.document.createElementNS(this.namespace,tag);
 	this.assignAttributes(domNode,{excludeEventAttributes: true});
 	parent.insertBefore(domNode,nextSibling);
 	this.renderChildren(domNode,null);