Description
An issue was discovered in MediaWiki 1.34.x before 1.34.4. On Special:Contributions, the NS filter uses unescaped messages as keys in the option key for an HTMLForm specifier. This is vulnerable to a mild XSS if one of those messages is changed to include raw HTML.
Remediation
References
Related Vulnerabilities
Magento Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2019-7872)
Oracle Database Server CVE-2009-0997 Vulnerability (CVE-2009-0997)
Jboss EAP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-3481)
WordPress Plugin WP Fastest Cache Unspecified Vulnerability (0.8.8.5)