Design/Logic Flaw

UEditor 1.4.3.3 has XSS via the SRC attribute of an IFRAME element...