yarr RSS reader iframe check allows javascript: XSS
A whitelisted host after javascript:// can hide script that runs when a subscriber opens the malicious post.
1 stories, newest first · one card per story
A whitelisted host after javascript:// can hide script that runs when a subscriber opens the malicious post.
Today 1.9K readers · 4.9K views · 3.6K reads · all time 163K views