This site allows anyone to inject content, you don't need an iframe.
https://joshcsimmons.com/post/eJyVlD2PgzAMhvf8Cm8HlcD76dSlf8...
Created using
wget "https://gist.githubusercontent.com/snipe/5512408/raw/db9f4051eeb1079de436ec5ae9ba9aff2a99549c/gistfile1.txt"
python3
>>> base64.b64encode(zlib.compress(b"<pre>" + open('gistfile1.txt', 'rb').read())).replace(b'/',b'%2F')