The vulnerability stems from unsanitized user input in Personal Preferences and Configuration modules. In Rails applications, controller actions (e.g., update) directly handle form parameters. The absence of input sanitization in these controllers (UsersController, ConfigurationController) and model save operations allows XSS payloads to persist. Page Parts/Fields are explicitly listed as affected components, implying their persistence logic lacks sanitization. Confidence is high for controllers due to direct parameter handling, and medium for models due to inferred storage logic.