CVE-2022-25276
The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circu…
Published: 2023-04-26 · CVSS: 6.1 · CVSS 3.1
The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7