XSS vulnerability while editing contacts

Preconditions
User has permission for edit own profile and logged in.

Steps to reproduce
1. Go to own profile, press button "Edit", press "Add contact"
2. Drag'n'drop (or paste via context menu) from anywhere (for example, from address bar) to "Contact Value" field follow text:

<script>alert('Hacked');</script>

3. Press "Ok"

Actual result
Pop up window with text "Hacked"

Expected result
Error message about wrong contact format

Note
XSS is special case. We can drag'n'drop (or paste via context menu) any invalid value to the textbox.
Drag'n'drop (or paste via context menu) should be validating same as paste via Ctrl+V or direct input