The vulnerability stems from improper XML escaping in sitemap generation. The _xmlify method directly injects URL values into XML templates using str_replace, without applying htmlspecialchars or equivalent encoding. The _validate method only handles URL formatting, not sanitization. Together, these allow unescaped user-controlled input (e.g., from custom page URLs) to be reflected in the sitemap.xml output. The GitHub advisory explicitly links to lines 79-83 in ia.admin.sitemap.php, which correspond to the URL injection logic in _xmlify. The patch in v4.1.4 likely added proper XML escaping to these functions.