While this is likely not an immediate security issue (unless there is an extension, which I'm currently not aware of, that allows what I've described below), I've still decided to file a private security task to report it, since extension code that would normally be safe can turn into an XSS vulnerability.

When reviewing the CookieConsent extension for a planned deployment to the Miraheze wiki farm, I stumbled upon this code. It sets the src attribute of all iframes that have the data-cookieconsent attribute to the value of the data-src attribute. However, a lot of tag extensions pass attributes that are provided by the user via wikitext to the HTML elements they create. While most extension tag implementations use the Sanitizer::validateAttributes function to remove attributes that could potentially be used for XSS, most data attributes, including data-src and data-cookieconsent are allowed by it. If there is an extension that creates iframes and adds user-provided attributes to the output, it is therefore possible to perform XSS by setting data-src to e.g. javascript:alert(1).

To avoid this, reserved data-attributes should be used. Sanitizer::isReservedDataAttribute disallows all data attributes starting with data-mw-.