The vulnerability exists in the Bulk Resize action, which is typically handled by a controller in MVC frameworks like Craft CMS. The changelog explicitly mentions fixing XSS in this action, indicating input sanitization was missing in the controller/view layer. Craft CMS plugins commonly use controllers to handle admin actions, and XSS would occur when unsanitized user input (e.g., filenames or parameters) is reflected in admin panels. The lack of escaping in the Bulk Resize interface before v2.0.9 would allow stored XSS via crafted input.