The WikibaseMediaInfo extension 1.35 for MediaWiki allows XSS because of improper template syntax within the PropertySuggestionsWidget template (in the templates/search/PropertySuggestionsWidget.mustache+dom file).
{ "cpes": [ "cpe:2.3:a:mediawiki:mediawiki:1.35:*:*:*:*:*:*:*" ], "severity": "Medium" }