Steps to reproduce
- Create some wikiset and change its wikis so that there is a log entry containing (none).
- Set MediaWiki:rightsnone to <img src=x onerror=alert(1)>.
- Either go to Special:Log or to Special:WikiSets/1 (the number of the edited wiki set needs to be choosen here).
- Enjoy your alert box.
This is possible due to an unescaped message:
case 'setchange': $args = [ $params[1] ?: wfMessage( 'rightsnone' )->text(), $params[2] ?: wfMessage( 'rightsnone' )->text() ]; break