The vulnerability stems from two key gaps: 1) Missing input sanitization when storing user-controlled data (address field), and 2) Lack of output encoding when displaying the address. The fix introduced a middleware (SanitizeInput) that applies strip_tags and htmlentities to inputs, indicating previous absence of these safeguards. While exact pre-patch controller code isn't shown, the XSS reproduction steps and patch context strongly imply that user input handling methods in controllers were vulnerable due to unvalidated storage and unescaped rendering.