diff --git a/Koha/Patron.pm b/Koha/Patron.pm
index 925d892e8b..29e32e52db 100644
--- a/Koha/Patron.pm
+++ b/Koha/Patron.pm
@@ -28,6 +28,7 @@ use Try::Tiny;
 use C4::Context;
 use C4::Auth qw( checkpw_hash );
 use C4::Log qw( logaction );
+use C4::Scrubber;
 use Koha::Account;
 use Koha::ArticleRequests;
 use C4::Letters qw( GetPreparedLetter EnqueueLetter SendQueuedMessages );
@@ -222,6 +223,12 @@ sub store {
               if defined $self->relationship
                      and $self->relationship eq "";
 
+            for my $note_field ( qw( borrowernotes opacnote ) ) {
+                if ( !$self->in_storage || $self->_result->is_column_changed($note_field) ) {
+                    $self->$note_field(C4::Scrubber->new('comment')->scrub($self->$note_field));
+                }
+            }
+
             unless ( $self->in_storage ) {    #AddMember
 
                 # Generate a valid userid/login if needed
diff --git a/t/db_dependent/Koha/Patron.t b/t/db_dependent/Koha/Patron.t
index 768be1a728..0cb4cd7180 100755
--- a/t/db_dependent/Koha/Patron.t
+++ b/t/db_dependent/Koha/Patron.t
@@ -19,7 +19,7 @@
 
 use Modern::Perl;
 
-use Test::More tests => 21;
+use Test::More tests => 22;
 use Test::Exception;
 use Test::Warn;
 
@@ -1673,3 +1673,36 @@ subtest 'update privacy tests' => sub {
 
     $schema->storage->txn_rollback;
 };
+
+subtest 'Scrub the note fields' => sub {
+    plan tests => 4;
+
+    $schema->storage->txn_begin;
+
+    my $bad_message     = '<script>alert("booh!")</script><span>all</span><b>good</b>now';
+    my $cleaned_message = '<span>all</span><b>good</b>now';
+    my $tmp_patron      = $builder->build_object( { class => 'Koha::Patrons' } );
+    my $patron_data     = $tmp_patron->unblessed;
+    $tmp_patron->delete;
+    delete $tmp_patron->{borrowernumber};
+
+    my $patron = Koha::Patron->new(
+
+        {
+            %$patron_data,
+            borrowernotes => $bad_message, opacnote => $bad_message,
+        }
+    )->store;
+
+    is( $patron->get_from_storage->borrowernotes, $cleaned_message );
+    is( $patron->get_from_storage->opacnote,      $cleaned_message );
+
+    $patron->borrowernotes($bad_message)->store;
+    $patron->opacnote($bad_message)->store;
+
+    is( $patron->get_from_storage->borrowernotes, $cleaned_message );
+    is( $patron->get_from_storage->opacnote,      $cleaned_message );
+
+    $schema->storage->txn_rollback;
+};
+