It parses untrusted input, the library is basically unmaintained, it’s not often audited but anytime someone looks they find a CVE.

This is answered in the article.

XSLT the idea contains few (but not zero) unavoidable security flaws.

libxslt the library is a barely-maintained dumpster fire of bad practices.