Multiple system messages are inserted into raw HTML without proper sanitization:

approvedrevs-approvedrevision
https://github.com/wikimedia/mediawiki-extensions-ApprovedRevs/blob/bccc58f799c77b3e5b4a17fd49b4d30e6e9981da/includes/ApprovedRevsHooks.php#L1315

1. Upload a file while ApprovedRevs is enabled
2. Go to the file page and append ?uselang=x-xss to the end of the URL (example URL: http://localhost:4001/wiki/File:TestFile.jpg?uselang=x-xss)

approvedrevs-approver
https://github.com/wikimedia/mediawiki-extensions-ApprovedRevs/blob/bccc58f799c77b3e5b4a17fd49b4d30e6e9981da/includes/ApprovedRevsHooks.php#L677

1. Have the viewapprover permission
2. Create an article in a namespace in which ApprovedRevs is enabled
3. Go to the revision history of the article and approve the edit you made while creating the page by clicking on the "approve" link after the edit summary
4. Go to the article you created and make sure that you are visiting it without the oldid parameter set, e.g. /w/index.php?title=ApprovedRevsTest
5. Append &uselang=x-xss to the end of the URL (example URL: http://localhost:4001/w/index.php?title=ApprovedRevsTest&uselang=x-xss)

approvedrevs-noapprovedrevision
This requires $egApprovedRevsShowNotApprovedMessage = true; in LocalSettings.
https://github.com/wikimedia/mediawiki-extensions-ApprovedRevs/blob/bccc58f799c77b3e5b4a17fd49b4d30e6e9981da/includes/ApprovedRevsHooks.php#L1229

1. Add $egApprovedRevsShowNotApprovedMessage = true; to your LocalSettings.php
2. Create a page in a namespace in which ApprovedRevs is enabled and make sure that no version of the page is approved
3. Append ?uselang=x-xss to the end of the URL (example URL: http://localhost:4001/wiki/ApprovedRevsTest3?uselang=x-xss)

approvedrevs-view
https://github.com/wikimedia/mediawiki-extensions-ApprovedRevs/blob/bccc58f799c77b3e5b4a17fd49b4d30e6e9981da/includes/specials/SpecialApprovedRevs.php#L80

1. To reproduce this vulnerability, the broken import in line 4 (https://github.com/wikimedia/mediawiki-extensions-ApprovedRevs/blob/bccc58f799c77b3e5b4a17fd49b4d30e6e9981da/includes/specials/SpecialApprovedRevs.php#L4) has to be changed from MediaWiki\Lineker\Linker to MediaWiki\Linker\Linker.
2. Go to Special:ApprovedRevs in your wiki and append ?uselang=x-xss to the end of the URL (example URL: http://localhost:4001/wiki/Special:ApprovedRevs?uselang=x-xss)

approvedrevs-approvedby
Some date formatting messages like may_long are also inserted here without sanitization.
https://github.com/wikimedia/mediawiki-extensions-ApprovedRevs/blob/bccc58f799c77b3e5b4a17fd49b4d30e6e9981da/includes/specials/SpecialApprovedRevs.php#L222

1. To reproduce this vulnerability, the broken import in line 4 (https://github.com/wikimedia/mediawiki-extensions-ApprovedRevs/blob/bccc58f799c77b3e5b4a17fd49b4d30e6e9981da/includes/specials/SpecialApprovedRevs.php#L4) has to be changed from MediaWiki\Lineker\Linker to MediaWiki\Linker\Linker.
2. Make sure that there is at least one article in your wiki that has an approved version
3. Go to Special:ApprovedRevs in your wiki and make sure the show parameter is set to all and the uselang parameter is set to x-xss (example URL: http://localhost:4001/w/index.php?title=Special:ApprovedRevs&show=all&uselang=x-xss)

Further information
I have tested all of those while being logged in, but most should also work when you're not logged in, depending on the configured user rights.
Browser: Firefox 138.0.1 (64-bit) on Fedora Linux 42
MediaWiki: 1.45.0-alpha (05406ba)
PHP: 8.3.14 (fpm-fcgi)
ApprovedRevs: 2.2.1 (bccc58f) 07:29, 12 May 2025