Last modified: 2009-10-28 19:10:08 UTC
In Extension:regexBlock, there is a message regexblock-unblock-error having a parameter $1 which is an invalid (nonexisting) user name. Likely, it should be enclosed in <nowiki> tag in the message, since it may include arbitary code.
Not sure it's an issue. The message is escaped with htmlspecialchars, which removes any injection threats.
Closed invalid per comment 1.