MediaWiki before 1.5.4 uses a hard-coded \internal placeholder string\ which allows remote attackers to bypass protection against cross-site scripting (XSS) attacks and execute Javascript using inline style attributes which are processed by Internet Explorer.