diff --git a/core/filter.js b/core/filter.js
index 37068b158a6..74cd39e815c 100644
--- a/core/filter.js
+++ b/core/filter.js
@@ -1779,10 +1779,8 @@
 			else
 				stripBlock( element, enterTag, toBeChecked );
 		}
-		// Special case - elements that may contain CDATA
-		// should be removed completely. <script> is handled
-		// by processProtectedElement().
-		else if ( name == 'style' )
+		// Special case - elements that may contain CDATA should be removed completely.
+		else if ( name in { style: 1, script: 1 } )
 			element.remove();
 		// The rest of inline elements. May also be the last resort
 		// for some special elements.
diff --git a/core/htmldataprocessor.js b/core/htmldataprocessor.js
index 4385ed65197..f7503b7d8de 100644
--- a/core/htmldataprocessor.js
+++ b/core/htmldataprocessor.js
@@ -869,7 +869,7 @@
 		var regexes = [
 			// Script tags will also be forced to be protected, otherwise
 			// IE will execute them.
-			( /<script[\s\S]*?<\/script>/gi ),
+			( /<script[\s\S]*?(<\/script>|$)/gi ),
 
 			// <noscript> tags (get lost in IE and messed up in FF).
 			/<noscript[\s\S]*?<\/noscript>/gi,
diff --git a/tests/core/filter/filter.js b/tests/core/filter/filter.js
index 0e2a6df3d06..4513db34ffa 100644
--- a/tests/core/filter/filter.js
+++ b/tests/core/filter/filter.js
@@ -745,6 +745,8 @@
 				'<p>X<!--{cke_protected}{C}%3C!%2D%2Dfoo%2D%2D%3E-->Y</p>',								'leave real comment' );
 			t( '<p>X<? echo 1; ?>Y</p>',
 				'<p>X<!--{cke_protected}%3C%3F%20echo%201%3B%20%3F%3E-->Y</p>',							'leave entire PHP code' );
+			t( '<script>alert(1);',									'@',								'strip entire script (no closing)' );
+			t( '<script><iframe src="foo"></iframe>',				'@',								'strip entire script (no closing, iframe inside)' );
 		},
 
 		'test leave protected elements': function() {
@@ -760,6 +762,14 @@
 				'<p>X<!--{cke_protected}%3C%3F%20echo%201%3B%20%3F%3E-->Y</p>',							'leave entire PHP code' );
 		},
 
+		// #13393
+		// The script's body may not be encoded if htmlDP was not used or if the encoding didn't work.
+		'test script removed completely when its body is not encoded': function() {
+			var filter = createFilter( 'p', false );
+
+			filter( '<p>X<script>alert(1);</scr' + 'ipt>X</p>',		'<p>XX</p>',						'strip whole element' );
+		},
+
 		'test strip entire elements which may contain cdata': function() {
 			var t = createFilterTester( editors.themed );
 
diff --git a/tests/core/htmldataprocessor.js b/tests/core/htmldataprocessor.js
index 5f503c3a484..0c426c2af30 100644
--- a/tests/core/htmldataprocessor.js
+++ b/tests/core/htmldataprocessor.js
@@ -754,6 +754,22 @@
 				bender.tools.fixHtml( dataP.toHtml( '<p><a data-href="x" href="#" src-foo="y">a</a></p>' ) ) );
 		},
 
+		// #13393
+		'test process malformed script': function() {
+			var dataP = this.editor.dataProcessor;
+
+			// What we check is that unclosed <script> tag will be protected.
+			assert.areSame( '<p>x</p><!--{cke_protected}%3Cscript%3E%3Ciframe%20src%3D%22foo%22%3E%3C%2Fiframe%3E-->',
+				dataP.toHtml( '<p>x</p><script><iframe src="foo"></iframe>' ) );
+			assert.areSame( '<p>x</p><!--{cke_protected}%3Cscript%3Ealert(1)%3B%3Cp%3Efoo%3C%2Fp%3E%3Cp%3Ebar%3C%2Fp%3E-->',
+				dataP.toHtml( '<p>x</p><script>alert(1);<p>foo</p><p>bar</p>' ) );
+			// Just to be sure that we don't swallow too much.
+			assert.areSame(
+				'<p>x</p><!--{cke_protected}%3Cscript%3Ealert(1)%3B%3C%2Fscript%3E-->' +
+				'<p>foo</p><!--{cke_protected}%3Cscript%3Ealert(2)%3B%3C%2Fscript%3E--><p>bar</p>',
+				dataP.toHtml( '<p>x</p><script>alert(1);</scr' + 'ipt><p>foo</p><script>alert(2);</scr' + 'ipt><p>bar</p>' ) );
+		},
+
 		'test toHtml event': function() {
 			var editor = this.editor,
 				calls = 0;
diff --git a/tests/tickets/13393/1.html b/tests/tickets/13393/1.html
new file mode 100644
index 00000000000..5b75a72df0b
--- /dev/null
+++ b/tests/tickets/13393/1.html
@@ -0,0 +1,19 @@
+<textarea id="editor1" cols="10" rows="10">
+	&lt;script><iframe src=javascript:alert(1)></iframe>
+</textarea>
+
+<textarea id="editor2" cols="10" rows="10">
+	&lt;script><iframe/src="javascript:alert(2)">
+</textarea>
+
+<textarea id="editor3" cols="10" rows="10">
+	&lt;script>alert(3);
+</textarea>
+
+<script>
+	CKEDITOR.replace( 'editor1' );
+	CKEDITOR.replace( 'editor2' );
+	CKEDITOR.replace( 'editor3', {
+		extraAllowedContent: 'script'
+	} );
+</script>
\ No newline at end of file
diff --git a/tests/tickets/13393/1.md b/tests/tickets/13393/1.md
new file mode 100644
index 00000000000..8a46a1bdff6
--- /dev/null
+++ b/tests/tickets/13393/1.md
@@ -0,0 +1,5 @@
+@bender-ui: collapsed
+@bender-tags: htmldataprocessor, filter, tc, 4.4.8, 13393
+@bender-ckeditor-plugins: wysiwygarea
+
+No alerts should be opened.
\ No newline at end of file