Is this a risk or is this an improvement?
If this is a risk, then how severe is it? Could a an attacker use this to bring the service down, or otherwise access confidential data? If so, I would try contacting the company directly. If you do so, don't even mention that you're currently interviewing for the company. I would approach this as if you had no affiliation with the company, so be just as respectful and professional as if you were speaking to them face-to-face.
If what you're proposing is an improvement, then save it for the interview or possibly afterwards. By improvement I mean an actual change to the behavior of the website, not just a simple fix. An example would be missing form validation or a script that crashes under certain circumstances. While it would probably be nice to have these things fixed, it's certainly not critical that they get fixed.
If the job you're applying for is related to the issue that you've found, then you might bring this up during the interview. It would show a level of understanding and research that could boost you past other potential candidates.
If the job you're applying for is unrelated to the job that you're applying for, save it for when you get hired. You don't want to bring up what you see as a "problem" during a time that they are trying to assess you. You also don't want to come across as threatening. However if you're working for the company, then you should be able to find out the right people to contact regarding your concern.
Also keep in mind that many companies operate on a limited budget. Some companies will outsource their web or IT work out to save on costs. Others will have a small team (sometimes it's just one person) that have to work on a huge number of projects. It's very well possible that someone is already aware of the problem or group of problems with the website, but other items take priority. Therefore if it's not going to be your priority if you land the job, then waiting until after you're hired will help all parties involved.
Whatever you do, don't bring the HR person into this. Nobody wants to be the guy saying "hey some person we've considered hiring has a problem with our work".