The vulnerability stemmed from improper output encoding in Razor views. Key issues included:

1. Directly rendering user-controlled values (e.g., item.Text, typeDisplayName) without encoding via Html.Encode() or Html.Raw().
2. The patches consistently addressed these by either removing Html.Raw() (relying on Razor's default encoding) or explicitly adding Html.Encode(). High-confidence examples include views like Manage.cshtml and Create.cshtml, where unencoded rendering of dynamic data was corrected. Controller changes (e.g., DashboardController) also contributed by simplifying data flow, but the primary XSS vectors were in view rendering.