Summary

A specifically crafted payload in request URL can inject HTML on blog page and exception pages.

Impact

XSS attack can be performed if the user clicks on specifically crafted links. As far as we know, the impact is limited and can not be exploited further other than basic XSS. It's still recommended to update your site.