The vulnerability stems from improper output encoding in the transformation feature's link generation. The commit 19df63b0365621427697edc185ff7c9c5707c523 explicitly shows that $options[1] (user-controlled transformation parameters) were being used unsanitized in an <a> tag's href attribute. The TextLinkTransformationsPlugin's applyTransformation method was the specific location where untrusted input entered the output stream without proper neutralization, matching the CVE description of XSS via crafted links in transformations.