## Summary
The #ipinfo extension has a infobox widget that is currently vulnerable to message key XSS (through checking with the `x-xss` language). These XSS vectors should be fixed.
## Background
- The `x-xss` language allows finding messages which are not properly escaped in MediaWiki interfaces
- The #IPinfo extension displays an "infobox" widget on pages like `Special:Contributions` that gives information about the IP address
- When using the `x-xss` language on `Special:Contributions`, there are several popup alerts that indicate the #ipinfo is not properly escaping these messages
## Technical notes
To reproduce:
# Set `$wgUseXssLanguage` to be `true`
# Load `Special:Contributions` for either a temporary account or IP
# Open the infobox
# Accept the IPInfo preference (if needed)
## Acceptance criteria
- [ ] The #ipinfo infobox component no longer has any messages that are vulnerable to message key XSS