The vulnerability stemmed from the plugin header parsing logic in yourls_get_plugin_data() which directly assigned user-controlled input (plugin metadata headers) to display values without HTML escaping. The fix in commit 04495e8 explicitly adds yourls_esc_html() sanitization to the header values, confirming this was the vulnerable code path. The function's role in processing plugin metadata makes it the clear injection point for stored XSS payloads.