The vulnerability stemmed from API endpoints handling tax operations without proper input validation or XSS protection. The patch removed these vulnerable endpoints from api_callbacks.php and relocated them to Laravel routes with 'xss' middleware while adding validation rules. The pre-patch TaxManager::save method accepted raw user input without length checks or sanitization, making the API callback handlers the primary injection vector. The medium confidence on delete_tax_item reflects that while less directly exploitable, it was part of the same vulnerable pattern.