SomeRandomDeveloper

Insufficient permission checks in action=growthsetmentor

Stored XSS through article extracts in GrowthExperiments

Stored XSS through system messages in Skin:BlueSky

Stored XSS through a system message in ImageRating

Stored XSS through a system message in UploadWizard

Stored XSS through system messages in AdvancedSearch

The CookieConsent extension does not properly use reserved data attributes, thus introducing potential XSS vectors

SQL injection in WatchAnalytics through Special:ClearPendingReviews

Stored XSS through system messages in PageForms

SQL injection in Cargo via Special:CargoExport