This is basically the same issue as T386175: CVE-2025-32072: HTML injection in feed output from i18n message, except in the API's action=feedcontributions class.
This applies to:
- Contributions message https://gerrit.wikimedia.org/g/mediawiki/core/+/efba8093d1b7792775073ba75ccf31e0440fc183/includes/api/ApiFeedContributions.php#114
- colon-separator message https://gerrit.wikimedia.org/g/mediawiki/core/+/efba8093d1b7792775073ba75ccf31e0440fc183/includes/api/ApiFeedContributions.php#238
Note that both are ->inContentLanguage(), so you'll need to set $wgLanguageCode = 'x-xss';, and then visiting a URL like http://localhost:4881/api.php?action=feedcontributions&format=json&user=Administrator&formatversion=2&uselang=x-xss, you'll see:
in which the <title> and <description> both have unescaped script tags. I didn't research whether this would be exploitable in any feed reader (presumably feed readers should be defensive against this), but just copying T386175.
Fix should be as simple as using ->escaped() as the output format. I'll post a patch in a few minutes.