I found a reflected XSS on Tumblr, I reported it and they said me this:
Thank you for this report. I have passed it along to our security team for consideration.They may contact you directly if they had additional questions. If you have any other discoveries, please do not hesitate to write back, and thank you for being part of the Tumblr community!
But I have not received more answers....