Reflected XSS via $request.wikiId in WikiManager/CreateWiki cleanUp step

Requirements

• None (guest accessible)

Explanation
CreateWiki.xml line 655 outputs $request.wikiId inside a html block without $escapetool.xml():

$services.localization.render('wiki.create.step.cleanUp.confirm', ["**${request.wikiId}**"])

The localization string renders as: You are about to delete wiki <strong>PAYLOAD</strong>. Please confirm.

The hidden input on line 657 correctly escapes it ($escapetool.xml($request.wikiId)).

This is the same bug as XWIKI-20297 but in CreateWiki, which was never patched.

POC
Visit as guest:

http://TARGET/xwiki/bin/view/WikiManager/CreateWiki?step=cleanUp&wikiId=<img+src%3Dx+onerror%3Dalert(document.domain)>

Alert fires immediately.

Impact
Guest reflected XSS. Send the link to an admin: XSS into full RCE. No account needed.

Fix

$services.localization.render('wiki.create.step.cleanUp.confirm', ["**${escapetool.xml($request.wikiId)}**"])

Also check lines 676 and 682 in the same file for the same pattern.

Tested on 18.2.1 and 18.3-snapshot