Cross-site Scripting (XSS)

mediawiki/core is vulnerable to cross-site scriptingattacks. The library does not properly escape characters in contributions-title message in SpecialContributions.php which is used as a page title, allowing an attacker to inject and execute malicious javascript through harmful HTML entities...