CheckUserLog allows CheckUser XSS because of date mishandling, as demonstrated by an XSS payload in MediaWiki:October. Reference: https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/CheckUser/+/79c2c49a18f96b159258958feca90fce964c350a https://phabricator.wikimedia.org/T292795
Created mediawiki tracking bugs for this issue: Affects: fedora-all [bug 2048951]
Please stop opening these bugs. These are against extensions that are NOT shipped in the mediawiki package.