OH! That’s very bad. Are you sure about this? Because in OneBox iframes, * has been used by default.
*
by default
Also/Alternatively, might there be any setting, which could allow any/all websites to be embedded?