diff --git a/src/Chamilo/CoreBundle/Component/HTMLPurifier/Filter/RemoveOnAttributes.php b/src/Chamilo/CoreBundle/Component/HTMLPurifier/Filter/RemoveOnAttributes.php
index 3447b5f39e5..7a7ef925ee5 100644
--- a/src/Chamilo/CoreBundle/Component/HTMLPurifier/Filter/RemoveOnAttributes.php
+++ b/src/Chamilo/CoreBundle/Component/HTMLPurifier/Filter/RemoveOnAttributes.php
@@ -17,10 +17,16 @@ public function preFilter($html, $config, $context)
 
     public static function filter($html)
     {
-        // Strip null bytes before regex matching to prevent bypass via on\x00load patterns
+        // Strip null bytes before regex matching to prevent bypass via on\x00load patterns.
         $html = str_replace("\0", '', $html);
-        $pattern = '/\s+on\w+\s*=\s*(?:"[^"]*"|\'[^\']*\'|[^\s>]+)/i';
+        $pattern = '/(?:=\s*(?:"[^"]*"|\'[^\']*\'|[^\s>]+))(*SKIP)(*F)|(?:\s+|\/+|(?<=["\']))on\w+\s*=\s*(?:"[^"]*"|\'[^\']*\'|[^\s>]+)/i';
 
-        return preg_replace($pattern, '', $html);
+        return preg_replace_callback(
+            '/<(?:[^>"\']+|"[^"]*"|\'[^\']*\')*>/s',
+            function ($matches) use ($pattern) {
+                return preg_replace($pattern, '', $matches[0]);
+            },
+            $html
+        );
     }
 }