I can put a <script> html tag in this website and have it render. You have blatant JavaScript injection vulnerabilities.