Twitter and various other web companies allow users to help translate the user interface into their language.
Crowdsourcing translations isn’t new for us. Since October, 2009, we’ve counted on Twitter users to volunteer as translators and help us localize Twitter.
An HTML template then probably substitutes delimited primary language strings with those from the output language. Since the output language strings come from an untrusted source, they could contain a payload to exploit an XSS vulnerability, or, if the results show up in feeds, an XML entity attack or the like.
Does anyone know whether such attacks have shown up in the wild?