Nikerabbit made a partial list of the (main) places, in core and several extensions, containing messages which don't escape text. Each of those messages is a potential security risk.
* Example actions to take: https://gerrit.wikimedia.org/r/#/q/topic:esc+owner:Nikerabbit,n,z
* Docs: https://www.mediawiki.org/wiki/Manual:Messages_API#Output_modes_and_escaping
```
== Core ==
=== Edit page/view page/protect page ===
/w/i.php?action=edit&title=Support word-separator
== WikiEditor ==
wikieditor-toolbar-group-format
wikieditor-toolbar-group-insert
wikieditor-toolbar-help-*
== Semantic MediaWiki ==
2016-11 additions:
* smw_result_noresults
* smw_sbv_docu
* smw-ask-format-selection-help
/wiki/Special:Browse smw_browse_article
/wiki/Special:Browse smw_browse_go
/wiki/Special:Browse categories
/wiki/Special:Browse smw_isspecprop
/wiki/Special:Browse isredirect
/wiki/Special:ExportRDF smw_exportrdf_backlinks
/wiki/Special:ExportRDF smw_exportrdf_docu
/wiki/Special:ExportRDF smw_exportrdf_lastdate
/wiki/Special:ExportRDF smw_exportrdf_recursive
/wiki/Special:ExportRDF smw_exportrdf_submit
/wiki/Special:Properties smw_isspecprop
/wiki/Special:Properties smw_propertyhardlyused
/wiki/Special:Properties smw_propertylackspage
/wiki/Special:Properties smw_property_template_notype
/wiki/Special:SearchByProperty smw_sbv_docu
/wiki/Special:SearchByProperty smw_sbv_property
/wiki/Special:SearchByProperty smw_sbv_submit
/wiki/Special:SearchByProperty smw_sbv_value
/wiki/Special:SMWAdmin smw_smwadmin_announce
/wiki/Special:SMWAdmin smw_smwadmin_announcebutton
/wiki/Special:SMWAdmin smw_smwadmin_announcedocu
/wiki/Special:SMWAdmin smw_smwadmin_datarefresh
/wiki/Special:SMWAdmin smw_smwadmin_datarefreshbutton
/wiki/Special:SMWAdmin smw_smwadmin_datarefreshdocu
/wiki/Special:SMWAdmin smw_smwadmin_db
/wiki/Special:SMWAdmin smw_smwadmin_dbbutton
/wiki/Special:SMWAdmin smw_smwadmin_dbdocu
/wiki/Special:SMWAdmin smw_smwadmin_docu
/wiki/Special:SMWAdmin smw_smwadmin_installfile
/wiki/Special:SMWAdmin smw_smwadmin_mediazilla
/wiki/Special:SMWAdmin smw_smwadmin_permissionswarn
/wiki/Special:SMWAdmin smw_smwadmin_questions
/wiki/Special:SMWAdmin smw_smwadmin_smwhomepage
/wiki/Special:SMWAdmin smw_smwadmin_support
/wiki/Special:SMWAdmin smw_smwadmin_supportdocu
/wiki/Special:SMWAdmin smw-sp-admin-settings-button
/wiki/Special:SMWAdmin smw-sp-admin-settings-title
/wiki/Special:Types/(Page|Text|Geographic_coordinates|Boolean) smw_typearticlecount
/wiki/Special:Types/(Page|Text|Geographic_coordinates|Boolean) smw_type_header
/w/i.php?-20in-20Flagged-20Revisions&printable=yes&title=Special:Browse/Summary:Support-2F-26quot;Deprecated-26quot%26-20in-20Flagged-20Revisions smw_browse_article
/w/i.php?-20in-20Flagged-20Revisions&printable=yes&title=Special:Browse/Summary:Support-2F-26quot;Deprecated-26quot%26-20in-20Flagged-20Revisions smw_browse_go
/w/i.php?-20in-20Flagged-20Revisions&printable=yes&title=Special:Browse/Summary:Support-2F-26quot;Deprecated-26quot%26-20in-20Flagged-20Revisions smw_browse_no_incoming
/w/i.php?-20in-20Flagged-20Revisions&printable=yes&title=Special:Browse/Summary:Support-2F-26quot;Deprecated-26quot%26-20in-20Flagged-20Revisions smw_browse_no_outgoing
== Lqt ==
/w/i.php?title=Thread:Support/About_MediaWiki:Randomincategory-nopages/ar&lqt_method=thread_history august
/w/i.php?title=Thread:Support/About_MediaWiki:Randomincategory-nopages/ar&lqt_method=thread_history december
/w/i.php?title=Thread:Support/About_MediaWiki:Randomincategory-nopages/ar&lqt_method=thread_history september
== MobileFrontend ==
Unescaped message mobile-frontend-diffview-comma
Unescaped message mobile-frontend-editor-unavailable
Unescaped message mobile-frontend-footer-sitename
Unescaped message mobile-frontend-copyright (might be obsolete?)
== Unsorted ==
Doubleescaped message scribunto-common-nosuchmodule
Unescaped message abusefilter-log-linkoncontribs
Unescaped message ajaxlogin-create
Unescaped message articlefeedbackv5-special-count-total
Unescaped message bibmanagercreate
Unescaped message bibmanagerimport
Unescaped message browsesw
Unescaped message categorytree-empty-bullet
Unescaped message centralauth-editset-legend-rw
Unescaped message colon‐separator
Unescaped message emptyfile
Unescaped message gwtoolset-ensure-well-formed-xml
Unescaped message linkedwiki-specialsparqlquery_endpointsparql
Unescaped message linkedwiki-specialsparqlquery_sendquery
Unescaped message login
Unescaped message mailmypassword
Unescaped message massaction-newtask
Unescaped message massaction-viewtask
Unescaped message pagedisqus-noscript
Unescaped message pagedisqus-title
Unescaped message pagetriage-welcome
Unescaped message remembermypassword
Unescaped message scribunto‐limitreport‐memusage
Unescaped message scribunto‐limitreport‐memusage‐value
Unescaped message scribunto‐limitreport‐timeusage
Unescaped message scribunto‐limitreport‐timeusage‐value
Unescaped message size‐megabytes
Unescaped message tags-create-explanation
Unescaped message timezoneselector-change-setting
Unescaped message wikibase‐limitreport‐entities‐accessed
Unescaped message wikimedia-copyright
Unescaped message yourname
Unescaped message yourpassword
```