Joomla! version 3.9.1 suffers from a persistent cross site scripting vulnerability in the global configuration textfilter settings.
Joomla Core - Stored XSS issue in the Global Configuration textfilter settings.
Joomla failes to perform adequate checks at the Global Configuration Text Filter settings which allows a stored XSS.
11/2018: First email to disclose the vulnerability to Joomla.
01/2019: Vendor published advisory and released a fix.