They're using WordPress version 4.3.1 which is affected by at least 3 vulnerabilities.