The patches show two distinct XSS vectors: 1) In facet option rendering where output lacked HTML escaping, and 2) In form parameter persistence where user input was embedded in HTML without sanitization. Both functions directly handle user-controllable data and were modified to add security controls (htmlspecialchars and XSS cleaning). The pre-patch versions of these functions would appear in profiler output when processing malicious payloads.