The vulnerability stems from unsanitized user input in perspective/view name fields. The patch adds two key mitigations: 1) Client-side sanitization using sanitizeString()/sanitizeName() in JavaScript handlers before storage, and 2) Server-side output encoding via htmlspecialchars() in PHP. The vulnerable functions are clearly the unpatched JavaScript event handlers that processed user input without these sanitization steps, allowing XSS payloads to be stored and later executed when rendered.