Pls. can you let me know (example) what I need to change in order to fix the issue? I haven't been working on the code since a long time.

The simplest solution is probably to use ->parse() instead of ->text() – ->parse() will HTML-escape any unsafe constructs in the input, and the result is safe to use in Html::rawElement(). (But this might be problematic if some of the messages contain things that shouldn’t be parsed as wikitext.)

In T322481#8374279, @Lucas_Werkmeister_WMDE wrote:

The simplest solution is probably to use ->parse() instead of ->text() – ->parse() will HTML-escape any unsafe constructs in the input, and the result is safe to use in Html::rawElement(). (But this might be problematic if some of the messages contain things that shouldn’t be parsed as wikitext.)

Thanks. Will consider this a.s.a.p.

Since MW 1.32, there is also $wgRawHtmlMessages, which requires some additional rights over editinterface for users to edit potentially-sensitive messages. This would be more of a middle ground between @Lucas_Werkmeister_WMDE's suggestion and the status quo.