Cross-site scripting (XSS) vulnerability in Special:PasswordReset in MediaWiki before 1.19.16 1.21.x before 1.21.10 and 1.22.x before 1.22.7 when wgRawHtml is enabled allows remote attackers to inject arbitrary web script or HTML via an invalid username.