The vulnerability stems from two key issues: 1) Insecure HTML generation in Form Manager's reference display logic where user-controlled values (form names, record data) were concatenated into DOM elements without HTML entity encoding. 2) Missing input sanitization when persisting form data, allowing XSS payloads to be stored. The patch explicitly adds SecurityUtility.encodeHtml() calls in the TypeScript/JavaScript view layer and ArrayUtility::stripTagsFromValuesRecursive in PHP controller actions to address these vectors. The functions identified directly handled untrusted data without these protections in vulnerable versions.