Nikerabbit made a partial list of the (main) places, in core and several extensions, containing messages which don't escape HTML. Each of those messages is a potential security risk.
* Example actions to take: https://gerrit.wikimedia.org/r/#/q/topic:esc+owner:Nikerabbit,n,z
* Docs: https://www.mediawiki.org/wiki/Manual:Messages_API#Output_modes_and_escaping
```
== Core ==
=== Edit page/view page/protect page ===
/w/i.php?action=edit&title=Support word-separator
=== Core special pages ===
/wiki/Special:UserLogin/signup titleblacklist-override
/w/i.php?title=Special:UserLogin&action=submitlogin&type=signup titleblacklist-override
== WikiEditor ==
wikieditor-toolbar-group-format
wikieditor-toolbar-group-insert
wikieditor-toolbar-help-*
== TwnMainPage ==
/wiki/Special:MainPage twnmp-bannerwho
== SMW/SF ==
/w/i.php?title=User:Nike&action=formedit summary
/wiki/Special:Browse smw_browse_article
/wiki/Special:Browse smw_browse_go
/wiki/Special:CreateCategory sf_createcategory_defaultform
/wiki/Special:CreateCategory sf_createcategory_makesubcategory
/wiki/Special:CreateCategory sf_createcategory_name
/wiki/Special:CreateForm sf_createform_addsection
/wiki/Special:CreateForm sf_createform_formlabel
/wiki/Special:CreateForm sf_createform_pagesection
/wiki/Special:CreateForm sf_createform_sectionlevel
/wiki/Special:CreateTemplate sf_createtemplate_deletefield
/wiki/Special:CreateTemplate sf_createtemplate_displaylabel
/wiki/Special:CreateTemplate sf_createtemplate_fieldislist
/wiki/Special:CreateTemplate sf_createtemplate_fieldname
/wiki/Special:CreateTemplate sf_createtemplate_outputformat
/wiki/Special:CreateTemplate sf_createtemplate_semanticproperty
/wiki/Special:ExportRDF smw_exportrdf_backlinks
/wiki/Special:ExportRDF smw_exportrdf_docu
/wiki/Special:ExportRDF smw_exportrdf_lastdate
/wiki/Special:ExportRDF smw_exportrdf_recursive
/wiki/Special:ExportRDF smw_exportrdf_submit
/wiki/Special:Forms sf_forms_docu
/wiki/Special:Properties smw_isspecprop
/wiki/Special:Properties smw_propertyhardlyused
/wiki/Special:Properties smw_propertylackspage
/wiki/Special:Properties smw_property_template_notype
/wiki/Special:SearchByProperty smw_sbv_docu
/wiki/Special:SearchByProperty smw_sbv_property
/wiki/Special:SearchByProperty smw_sbv_submit
/wiki/Special:SearchByProperty smw_sbv_value
/wiki/Special:SMWAdmin smw_smwadmin_announce
/wiki/Special:SMWAdmin smw_smwadmin_announcebutton
/wiki/Special:SMWAdmin smw_smwadmin_announcedocu
/wiki/Special:SMWAdmin smw_smwadmin_datarefresh
/wiki/Special:SMWAdmin smw_smwadmin_datarefreshbutton
/wiki/Special:SMWAdmin smw_smwadmin_datarefreshdocu
/wiki/Special:SMWAdmin smw_smwadmin_db
/wiki/Special:SMWAdmin smw_smwadmin_dbbutton
/wiki/Special:SMWAdmin smw_smwadmin_dbdocu
/wiki/Special:SMWAdmin smw_smwadmin_docu
/wiki/Special:SMWAdmin smw_smwadmin_installfile
/wiki/Special:SMWAdmin smw_smwadmin_mediazilla
/wiki/Special:SMWAdmin smw_smwadmin_permissionswarn
/wiki/Special:SMWAdmin smw_smwadmin_questions
/wiki/Special:SMWAdmin smw_smwadmin_smwhomepage
/wiki/Special:SMWAdmin smw_smwadmin_support
/wiki/Special:SMWAdmin smw_smwadmin_supportdocu
/wiki/Special:SMWAdmin smw-sp-admin-settings-button
/wiki/Special:SMWAdmin smw-sp-admin-settings-title
/wiki/Special:Templates sf_templates_docu
/wiki/Special:Types/(Page|Text|Geographic_coordinates|Boolean) smw_typearticlecount
/wiki/Special:Types/(Page|Text|Geographic_coordinates|Boolean) smw_type_header
/w/i.php?-20in-20Flagged-20Revisions&printable=yes&title=Special:Browse/Summary:Support-2F-26quot;Deprecated-26quot%26-20in-20Flagged-20Revisions smw_browse_article
/w/i.php?-20in-20Flagged-20Revisions&printable=yes&title=Special:Browse/Summary:Support-2F-26quot;Deprecated-26quot%26-20in-20Flagged-20Revisions smw_browse_go
/w/i.php?-20in-20Flagged-20Revisions&printable=yes&title=Special:Browse/Summary:Support-2F-26quot;Deprecated-26quot%26-20in-20Flagged-20Revisions smw_browse_no_incoming
/w/i.php?-20in-20Flagged-20Revisions&printable=yes&title=Special:Browse/Summary:Support-2F-26quot;Deprecated-26quot%26-20in-20Flagged-20Revisions smw_browse_no_outgoing
== InviteSignup ==
/wiki/Special:InviteSignup group-translator-member
/wiki/Special:InviteSignup is-tableth-date
/wiki/Special:InviteSignup is-tableth-email
/wiki/Special:InviteSignup is-tableth-groups
/wiki/Special:InviteSignup is-tableth-inviter
/wiki/Special:InviteSignup is-tableth-signup
== Replace Text ==
/wiki/Special:ReplaceText replacetext_categorysearch
/wiki/Special:ReplaceText replacetext_prefixsearch
== Translate ==
/w/i.php?title=MediaWiki:Ipbreason-dropdown&action=edit translate-edit-definition
/wiki/Special:PagePreparation pp-prepare-message
== Lqt ==
/w/i.php?title=Thread:Support/About_MediaWiki:Randomincategory-nopages/ar&lqt_method=thread_history august
/w/i.php?title=Thread:Support/About_MediaWiki:Randomincategory-nopages/ar&lqt_method=thread_history december
/w/i.php?title=Thread:Support/About_MediaWiki:Randomincategory-nopages/ar&lqt_method=thread_history september
```