Security Review - Untrusted users are allowed to input dangerous HTML tags I am getting the following error in my security review:
Untrusted users are allowed to input dangerous HTML tags.

Is this because in my text formats I've got the following:
Plain text  All roles may use this format

Should I disable  anonymous users from being able to access plain text?

Also, it is saying:
It is recommended you remove the following tags from roles accessible by untrusted users.

img


Should I remove the img tag from authenticated users???? Does this mean that authenticated users will not be able to uploaded images to their site at all?
Plain text is just that, no html tags, so this shouldn't be a security issue.

Perhaps the img tag is considered dangerous because it is possible to use a specially crafted png or jpg to launch an attack against a users browser.