The vulnerability stems from unescaped output of user-controlled parameters in search form fields. The GitHub patch shows critical additions of Moodle's s() escaping function to value attributes in multiple field classes' display_search_field methods and author name inputs in lib.php. These functions received user input via URL parameters (f_* fields and u_fn/u_ln) and rendered them without proper HTML entity encoding, enabling XSS injection. The consistent pattern of adding s() in the fix confirms these were the vulnerable points.