SomeRandomDeveloper

ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS

Stored XSS through URLs in Cargo's map format

CSS injection in multiple Cargo display formats

Stored XSS through the dynamic table format in Cargo

i18n XSS, DoS and config SQLI in Monaco

Stored XSS through edit summaries in GrowthExperiments

Stored XSS through autocomment system messages in Wikibase

ApprovedRevs allows bypassing the inline CSS sanitizer

Stored XSS through a system message and a user-provided parameter in ProofreadPage

The CookieConsent extension does not properly use reserved data attributes, thus introducing potential XSS vectors