1. Use Special:CreateTemplate to create a template
2. Add "<script>alert(1);</script>" to the Field name.
3. Go to Special:CreateForm, and add the template to the form
4. Script is executed

It looks like Special:CreateTemplate can be called by anyone.

The Special:CreateForm post to add the template doesn't check the csrf token, so it can be submitted for a user via csrf.