The issue is related to insufficient cleaning of user data when processing external links, allowing a user to inject and execute arbitrary HTML code and scripts in the user's browser within the context of the vulnerable website. This can enable a remote attacker to steal potentially confidential information, modify the appearance of web pages, and perform phishing and drive-by download attacks.