Description
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On ChangesList special pages such as Special:RecentChanges and Special:Watchlist, some of the rcfilters-filter-* label messages are output in HTML unescaped, leading to XSS.
Remediation
References
Related Vulnerabilities
WordPress Plugin Related Posts Cross-Site Scripting (5.12.91)
SharePoint CVE-2021-24104 Vulnerability (CVE-2021-24104)
Moodle Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2011-4203)
Jenkins Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-2064)