diff -u b/core/modules/user/lib/Drupal/user/Tests/UserAutocompleteTest.php b/core/modules/user/lib/Drupal/user/Tests/UserAutocompleteTest.php
--- b/core/modules/user/lib/Drupal/user/Tests/UserAutocompleteTest.php
+++ b/core/modules/user/lib/Drupal/user/Tests/UserAutocompleteTest.php
@@ -47,11 +47,12 @@
     // Using first letter of the user's name, make sure the user's full name is in the results.
     $this->assertRaw($this->unprivileged_user->name, 'User name found in autocompletion results.');
 
-    $anonymous_name = $this->randomString();
+    $anonymous_name = $this->randomString() . '<script>alert();</script>';
     config('user.settings')->set('anonymous', $anonymous_name)->save();
-    // Test that anonymous username is in the result when requested.
+    // Test that anonymous username is in the result when requested and escaped
+    // with check_plain().
     $users = $this->drupalGetAjax('user/autocomplete/anonymous', array('query' => array('q' => drupal_substr($anonymous_name, 0, 4))));
-    $this->assertTrue(isset($users[$anonymous_name]), 'The anonymous name found in autocompletion results.');
+    $this->assertTrue(in_array(check_plain($anonymous_name), $users), 'The anonymous name found in autocompletion results.');
     $users = $this->drupalGetAjax('user/autocomplete', array('query' => array('q' => drupal_substr($anonymous_name, 0, 4))));
     $this->assertFalse(isset($users[$anonymous_name]), 'The anonymous name not found in autocompletion results without enabling anonymous username.');
   }