The blog was previously vulnerable to XSS (cross site scripting) & SQL Injection.