In Joomla! prior to 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest users.
joomla joomla\\! 2.5.0
joomla joomla\\!