mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function (CVE-2026-52854) | HOL Guard CVE