This exploit leverages two vulnerabilities in jQuery: CVE-2020-7656 which allows for XSS through improper script handling, and CVE-2019-11358 which leads to XSS due to Prototype Pollution. By injecting payloads into a vulnerable page running jQuery versions prior to 3.4.X, malicious actors can run arbitrary JavaScript code in the victim's browser.