Steps to reproduce
- Create some article Test.
- Set MediaWiki:June to <img src=x onerror=alert(1)> (the month of the article creations needs to be choosen here).
- Go to Special:Search and search for Test, so that the newly created article shows up.
- Enjoy your alert box.
This is possible, because the date value is not being escaped.
$date = $this->specialPage->getLanguage()->userTimeAndDate( $result->getTimestamp(), $this->specialPage->getUser() );