Risk: Low
Input passed to the "query" parameter when performing a search isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
The vulnerability has been reported in version 4. Other versions may also be affected.