MediaWiki upstream has released: [1] http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-July/000092.html

v1.16.0 and v.1.15.5 versions of MediaWiki, addressing the following XSS flaw (from [1]):

A cross-site scripting (XSS) vulnerability was discovered in profileinfo.php. The vulnerability is only exposed when the script is explicitly enabled in LocalSettings.php, with $wgEnableProfileInfo = true.

Tim Starling reported: [1] https://bugzilla.wikimedia.org/showbug.cgi?id=24565#c0

a deficiency in the way MediaWiki processed private cache headers for almost all API operations. Further exact flaw implications from Tim [1]:

A user's browser can be tricked into requesting private data with public caching headers, via a CSRF-style attack on an external web page. The attacker would cause the victim's browser to request private data with public caching headers, then the attacker would download the same data from the intermediate HTTP proxy, bypassing access controls.

References: [2] http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-July/000092.html

Cross-site scripting (XSS) vulnerability in the Special:Block implementation in the getContribsLink function in SpecialBlockip.php in MediaWiki 1.14.0 and 1.15.0 allows remote attackers to inject arbitrary web script or HTML via the ip parameter.