Nikerabbit made a partial list of the (main) places, in core and several extensions, containing messages which don't escape text. Each of those messages is a potential security risk.
* Example actions to take: https://gerrit.wikimedia.org/r/#/q/topic:esc+owner:Nikerabbit,n,z
* Docs: https://www.mediawiki.org/wiki/Manual:Messages_API#Output_modes_and_escaping
```
== Core ==
=== Edit page/view page/protect page ===
/w/i.php?action=edit&title=Support word-separator
== WikiEditor ==
wikieditor-toolbar-group-format
wikieditor-toolbar-group-insert
wikieditor-toolbar-help-*
== Semantic MediaWiki ==
/wiki/Special:Browse smw_browse_article
/wiki/Special:Browse smw_browse_go
/wiki/Special:Browse categories
/wiki/Special:Browse smw_isspecprop
/wiki/Special:Browse isredirect
/wiki/Special:ExportRDF smw_exportrdf_backlinks
/wiki/Special:ExportRDF smw_exportrdf_docu
/wiki/Special:ExportRDF smw_exportrdf_lastdate
/wiki/Special:ExportRDF smw_exportrdf_recursive
/wiki/Special:ExportRDF smw_exportrdf_submit
/wiki/Special:Properties smw_isspecprop
/wiki/Special:Properties smw_propertyhardlyused
/wiki/Special:Properties smw_propertylackspage
/wiki/Special:Properties smw_property_template_notype
/wiki/Special:SearchByProperty smw_sbv_docu
/wiki/Special:SearchByProperty smw_sbv_property
/wiki/Special:SearchByProperty smw_sbv_submit
/wiki/Special:SearchByProperty smw_sbv_value
/wiki/Special:SMWAdmin smw_smwadmin_announce
/wiki/Special:SMWAdmin smw_smwadmin_announcebutton
/wiki/Special:SMWAdmin smw_smwadmin_announcedocu
/wiki/Special:SMWAdmin smw_smwadmin_datarefresh
/wiki/Special:SMWAdmin smw_smwadmin_datarefreshbutton
/wiki/Special:SMWAdmin smw_smwadmin_datarefreshdocu
/wiki/Special:SMWAdmin smw_smwadmin_db
/wiki/Special:SMWAdmin smw_smwadmin_dbbutton
/wiki/Special:SMWAdmin smw_smwadmin_dbdocu
/wiki/Special:SMWAdmin smw_smwadmin_docu
/wiki/Special:SMWAdmin smw_smwadmin_installfile
/wiki/Special:SMWAdmin smw_smwadmin_mediazilla
/wiki/Special:SMWAdmin smw_smwadmin_permissionswarn
/wiki/Special:SMWAdmin smw_smwadmin_questions
/wiki/Special:SMWAdmin smw_smwadmin_smwhomepage
/wiki/Special:SMWAdmin smw_smwadmin_support
/wiki/Special:SMWAdmin smw_smwadmin_supportdocu
/wiki/Special:SMWAdmin smw-sp-admin-settings-button
/wiki/Special:SMWAdmin smw-sp-admin-settings-title
/wiki/Special:Types/(Page|Text|Geographic_coordinates|Boolean) smw_typearticlecount
/wiki/Special:Types/(Page|Text|Geographic_coordinates|Boolean) smw_type_header
/w/i.php?-20in-20Flagged-20Revisions&printable=yes&title=Special:Browse/Summary:Support-2F-26quot;Deprecated-26quot%26-20in-20Flagged-20Revisions smw_browse_article
/w/i.php?-20in-20Flagged-20Revisions&printable=yes&title=Special:Browse/Summary:Support-2F-26quot;Deprecated-26quot%26-20in-20Flagged-20Revisions smw_browse_go
/w/i.php?-20in-20Flagged-20Revisions&printable=yes&title=Special:Browse/Summary:Support-2F-26quot;Deprecated-26quot%26-20in-20Flagged-20Revisions smw_browse_no_incoming
/w/i.php?-20in-20Flagged-20Revisions&printable=yes&title=Special:Browse/Summary:Support-2F-26quot;Deprecated-26quot%26-20in-20Flagged-20Revisions smw_browse_no_outgoing
== Translate ==
/w/i.php?title=MediaWiki:Ipbreason-dropdown&action=edit translate-edit-definition
/wiki/Special:PagePreparation pp-prepare-message
== Lqt ==
/w/i.php?title=Thread:Support/About_MediaWiki:Randomincategory-nopages/ar&lqt_method=thread_history august
/w/i.php?title=Thread:Support/About_MediaWiki:Randomincategory-nopages/ar&lqt_method=thread_history december
/w/i.php?title=Thread:Support/About_MediaWiki:Randomincategory-nopages/ar&lqt_method=thread_history september
== Unsorted ==
Doubleescaped message scribunto-common-nosuchmodule
Unescaped message ajaxlogin-create
Unescaped message articlefeedbackv5-special-count-total
Unescaped message bibmanagercreate
Unescaped message bibmanagerimport
Unescaped message browsesw
Unescaped message centralauth-editset-legend-rw
Unescaped message colon‐separator
Unescaped message emptyfile
Unescaped message gwtoolset-ensure-well-formed-xml
Unescaped message limitreport‐cputime
Unescaped message limitreport‐cputime‐value
Unescaped message limitreport‐expansiondepth
Unescaped message limitreport‐expansiondepth‐value
Unescaped message limitreport‐expensivefunctioncount
Unescaped message limitreport‐expensivefunctioncount‐value
Unescaped message limitreport‐postexpandincludesize
Unescaped message limitreport‐postexpandincludesize‐value
Unescaped message limitreport‐ppgeneratednodes
Unescaped message limitreport‐ppgeneratednodes‐value
Unescaped message limitreport‐ppvisitednodes
Unescaped message limitreport‐ppvisitednodes‐value
Unescaped message limitreport‐templateargumentsize
Unescaped message limitreport‐templateargumentsize‐value
Unescaped message limitreport‐walltime
Unescaped message limitreport‐walltime‐value
Unescaped message linkedwiki-specialsparqlquery_endpointsparql
Unescaped message linkedwiki-specialsparqlquery_sendquery
Unescaped message login
Unescaped message mailmypassword
Unescaped message massaction-newtask
Unescaped message massaction-viewtask
Unescaped message mobile-frontend-copyright
Unescaped message mobile-frontend-footer-sitename
Unescaped message mwe-upwiz-add-flickr-or
Unescaped message mwe-upwiz-error-blank
Unescaped message mwe-upwiz-file-all-failed
Unescaped message mwe-upwiz-file-some-failed
Unescaped message mwe-upwiz-multi-file-select
Unescaped message pagedisqus-noscript
Unescaped message pagedisqus-title
Unescaped message pagetriage-welcome
Unescaped message parentheses
Unescaped message remembermypassword
Unescaped message scribunto‐limitreport‐memusage
Unescaped message scribunto‐limitreport‐memusage‐value
Unescaped message scribunto‐limitreport‐timeusage
Unescaped message scribunto‐limitreport‐timeusage‐value
Unescaped message size‐megabytes
Unescaped message tags-create-explanation
Unescaped message timezoneselector-change-setting
Unescaped message twnmp-choose-fill-account-details
Unescaped message wikibase‐limitreport‐entities‐accessed
Unescaped message wikimedia-copyright
Unescaped message word-separator
Unescaped message yourname
Unescaped message yourpassword
```