Arbitrary OBJECTs can be embedded if DATA tag is used.

function embedfilter_approve's default behavior is to return TRUE. Because the regex only scans for HREF and SRC elements to match against the whitelist, it is possible for an OBJECT or EMBED tag with a DATA element to pass through without the domain being checked, and subsequently render on page load. This allows users to embed content from third-party sites that are not on the whitelist, ie <OBJECT DATA="http://evilsite.com/evil.swf" scriptaccess="ALL">

To fix:

1. Return FALSE unless we've run the whitelist check. We can do this by changing line 259* from :

return TRUE;

to

return (!empty($matches[3]))?TRUE:FALSE instead of return TRUE;

2. Add 'data' to the list of tags that the regex scans for on line 250* and 276*

* actual line numbers may be inaccurate as I've made a number of changes to the core file in order to debug it.